As an idP Administrator, I would like to be able to select the attributes including user details and group memberships to be updated upon JIT provisioning.

At present, Confluence's JIT provisioning functionality requires an absolute group attribute and it cannot be blank. Putting a dummy attribute will trigger an error.

Existing group memberships defined in Confluence will be replaced by the group attribute defined in the idP.

In most use-case for JIT, there is an option to allow group attributes to be synced or not and users will be added to a default group like confluence-users. Currently, third-party apps offer JIT provisioning with such capability.