Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know you can use Facebook as an identity provider but it seems to be limited to "regular" users. Can you also use Facebook as an identity provider in the portal? How does it match back to a user record, just by email address?

share|improve this question

You can use it with a portal (see step 11 in the documentation). The user's Facebook ID is associated with their Salesforce user record. You receive their name and email in the registration handler when they SSO in.

The registration handler can use the incoming Auth.UserData to query for a match on an existing user and either create a new user or return an existing user as appropriate.

Here is a sample registration handler that illustrates the above:

public class PortalHandler implements Auth.RegistrationHandler{
    // createUser is called when there is no existing user linked 
    // to the incoming third party account
    public User createUser(Id portalId, Auth.UserData data){
        User u;

        // Use incoming email for username, since we're working with a 
        // portal user
        List<User> l = [SELECT Id FROM User WHERE UserName =];
        if (l.size() > 0) {
            u = l[0];
            System.debug('Found existing user record for '+data.username);

            // Update existing record
            u.Email =;
            u.LastName = data.lastName;
            u.FirstName = data.firstName;
            // Useful to save the Facebook ID in a custom field
            u.Facebook_ID__c = data.identifier;

            System.debug('Updating user record for '+data.username);

        } else {
            // Portal users need an associated contact, which, in turn,
            // needs to be associated with an account.
            // For simplicity, just put all contacts on the sForce account
            Account a = [SELECT Id FROM Account WHERE Name='sForce'];

            Contact c = new Contact();
            c.AccountId = a.Id;
            c.Email =;
            c.FirstName = data.firstName;
            c.LastName = data.lastName;

            u = new User();
            Profile p = [SELECT Id FROM profile WHERE name='High Volume Customer Portal'];

            u.UserName =;
            u.Email =;
            u.LastName = data.lastName;
            u.FirstName = data.firstName;
            u.Facebook_ID__c = data.identifier;
            u.Alias = (data.username != null) ? data.username : data.identifier;
            if (u.Alias.length() > 8) {
                u.Alias = u.Alias.substring(0, 8);
            u.Languagelocalekey = UserInfo.getLocale();
            u.Localesidkey = UserInfo.getLocale();
            u.EmailEncodingKey = 'UTF-8';
            u.TimeZoneSidKey = 'America/Los_Angeles';
            u.ProfileId = p.Id;
            u.ContactId = c.Id;

            System.debug('Returning new user record for '+data.username);

        return u;

    // updateUser is called when there is a match with an existing user
    public void updateUser(Id userId, Id portalId, Auth.UserData data){
        User u = new User(Id=userId);

        u.Email =;
        u.LastName = data.lastName;
        u.FirstName = data.firstName;
        u.Facebook_ID__c = data.identifier;

        System.debug('Updating user record for '+data.username);

share|improve this answer
Any way to link them post-registration? – Shane McLaughlin Feb 13 '13 at 0:03
Yes - this functionality was added in Winter '13 - code sample added to my answer to illustrate this. – metadaddy Feb 13 '13 at 6:05
Just wondering if global is still needed here? – Andrew Fawcett Feb 13 '13 at 7:54
@AndrewFawcett Good question. Just checked. It's not. Sample updated. – metadaddy Feb 13 '13 at 15:58
@metadaddy Can you please confirm that how salesforce determines that there is a match between exiting user and incoming third party user ? I am trying to using facebook as a identity provider for portal users but I am facing error so I just want to confirm whether Is the third party user's email-id is checked for a existing user or is there any other approach followed by salesforce ? – S.Sharma Oct 1 '13 at 1:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.