Single Sign-On in Action and JIT Provisioning with Natalya Murphy
Вставка
- Опубліковано 5 вер 2024
- This session looks at SSO with multiple Salesforce orgs, with G-Suite and then we look at JIT provisioning with SAML and Connects Apps.
With thanks to guest presenters Igor Androsov, Amit Jain and David Bergerson.
Great work on the demos. Would've loved to see JIT demo as well.
Does SAML JIT provides deprovisioning of users? Or does it only provide Create and Update?
Thanks
absolutely no useful information about JIT , a lot of presentation was spent on SSO.
It was really bothering me how the RegistrationHandler matched users as well. I worked it out with a peer. I noticed that when you log in using for example Open Id Connect or Social Sign On, Salesforce creates a 'ThirdPartyAccountLink' child record for that user (look at the user related list). You can query this object using devconsole if needed. This record stores some information such as which authprovider was used and most importantly the identifier for that user. Before the Registration handler is called, Salesforce queries for a ThirdPartyAccountLink that has a matching identifier (and auth provider) to the UserData returned from facebook for example. If it finds one, it has the Salesforce userID and calls the updateUser() method in the RegHandler, otherwise if it does not find one it calls the createUser() method and uses the returned user to insert a ThirdPartyAccountLink so that next time the user logs in, SF knows which user it is. Absolutely NO documentation regarding this, but I needed to understand it before implementing it for a client!
Really appreciate the demo but using japanese UI language was not helpful at all. Part of the study task is to understand the different roles, endpoints etc and be able to map these fields between IdP Org and dependent Org. Having the labels be in non-English is quite challenging and counterproductive. Better to give Both Orgs very distinct colors (e.g. Blue & Red) and give them corresponding My Domains
Lacking in explaining some of the fundamentals - why connectedapp, saml, oauth. Everyone is guessing here.
If you came across any good video on them, please do let us know. I struggle with the same. There are OAuth videos in general, but don’t relate then with connected app. Same thing with saml. If someone could explain what is entity id etc (the concept behind them), it would be good.
Shame David didn't have anything to show and tell. That was all I was interested.
The japanese org didn't really add any value; it just confused things