I am trying to send User, Contact and Account related fields through SAML Response. But while configuring the SAML attributes in the Connected App, I only see User, Profile, Org, and few more Objects but not Contact and Account. Salesforce doc says JIT searches User record based on Contact.Email and Contact.Lastname. I am not finding Contact object.
1 Answer
Custom attributes in a Connected app to be used in SAML configuration can only be on the User object. This is from the documentation:
A custom attribute can be any custom field added to the User object in the organization, as long as it is one of the following data types: Email, Text, URL, or Formula (with Text Return Type). After you select Custom Attribute for the Subject Type, Salesforce displays a Custom Attribute field with a list of the available User object custom fields in the organization.
The statement that you are referring highlights how JIT works in case of Community when it finds the Subject in the assertion, and compares it with Contact fields.
answered Apr 16, 2019 at 18:24
-
Hey Jayant, thanks for the response, but check this Salesforce doc, developer.salesforce.com/docs/atlas.en-us.sso.meta/sso/… under "Supported Fields for the Community SAML Assertion". Commented Apr 16, 2019 at 18:27
-
You are confusing yourself with two different things. With what you have in your question, you can only create the custom attributes in a connected app as mentioned in the docs. With what you have linked in your comment says what can you send with an assertion while verifying a User specific to Community. You don't need e.g., Account when you perform a SSO/JIT for regular Users. Commented Apr 16, 2019 at 18:34
-
How those two are different? whatever you set in the Connected App Custom attributes, those only will be passed in the SAML Assertion right. For example, if I am creating a new community user using JitHandler + SAML, then I would want to get the Contact details as well like I get the User.FirstName, User.LastName. Commented Apr 16, 2019 at 18:53
-
Not necessarily. A SAML assertion can be sent from any IdP and that's what it mentions for Community scenario as what can you send. In your use case you are trying to set your Salesforce instance as an IdP and if you want to utilize any other attributes on the assertion by using Connected Apps, you are limited to what the Connected App offers. The topics here are very much different with the context they operate upon. Commented Apr 16, 2019 at 18:56