0

We have a client whose users would be using the same SSO identity provider to log into Salesforce, and also to log into an external service the client owns. We are also building an integration from Salesforce to that external service, but the integration uses a single API superuser.

Since the same SSO provider is used for both, the client is wondering if Salesforce has any capability to query the username from the SSO provider in order to be able to to pass that username to the external service in API requests.

I see that the ThirdPartyAccountLink object (https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_objects_thirdpartyaccountlink.htm) is where the SSO usernames are stored. So that's a good help. My question: Is there any way (in Apex, Visualforce, JS or whatever) to determine which SSO provider, if any, was used to log the user into their current session?

Improve this question

1 Answer 1

Reset to default
2

Current session info can be obtained via SessionManagement class but it won't have the information you're looking for because SSO protocol message is not stored in the session.

When the user logs into to Salesforce via identity provider, you can pass information about the user to SF. This holds true in all major SSO protocols that SF supports. The techniques to intercept and extract info passed in a protocol message to Salesforce during authentication depend on the protocol. You'd have to make assumptions and choose the SSO protocols you'll support in your managed package and/or create interceptors for all protocols. Once you intercept the protocol message, you can then extract the relevant parts and store them in session via Cache.Session and Cache.SessionPartition APIs / classes

Interceptors:

Social SSO (Facebook, Google, etc): look at RegistrationHandler class

SAML: Just-in-Time provisioning must be enabled and SamlJitHandler is the class to intercept the message

oAuth / OpenID Connect: look at AuthProviderPluginClass

You can see what authentication methods are available for a particular org (with MyDomain enabled) or community via AuthConfiguration class https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_class_Auth_AuthConfiguration.htm

Improve this answer
5
  • Thanks. Unfortunately I don't think either of those will fit the use case. We won't have control over the setup of the SSO. I oversimplified - we're actually writing a managed package. Subscribers would be using the same SSO identity provider to log into Salesforce, and also to log into an external service the client owns. The client was suggesting that admins could specify that if the user logged into Salesforce via a specific identity provider, our app should fetch that username and pass it to certain requests.
    – Charles T
    Jan 21, 2018 at 13:50
  • @CharlesT Managed packaged makes it more complicated but the key issue is interception of SSO protocol message. I edited the answer, hope this helps.
    – identigral
    Jan 22, 2018 at 21:22
  • Appreciated. I see also that it is possible to query AuthSession where isCurrent=true and get the LoginHistory.AuthenticationService ID. So perhaps that answers my "which SSO provider" question. There is also IdpEventLog which looks up to AuthSession but I think that's for the other way around, the events logged when Salesforce is being the IDP.
    – Charles T
    Jan 23, 2018 at 4:39
  • IdP event log has events for both inbound and outbound messages. AuthSession with isCurrent=true is useful but it's worth noting that out of the box the same user can have multiple, concurrent sessions.
    – identigral
    Jan 23, 2018 at 19:57
  • Thanks, I will have to mock up an environment to test all that as none of our clients are using SSO right now. I do see that AuthSession WHERE isCurrent=true returns one parent session and all its child sessions, and all share the same LoginHistoryID. I can also confirm that if I log in as the same user in two browsers concurrently, the same isCurrent=true query gives different results in each and they do not return each other's sessions.
    – Charles T
    Jan 23, 2018 at 20:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .