In Salesforce, when configuring an Auth. Provider, we can create and customize a Registration Handler Class implementing this interface
there are two methods that need to be implemented:
global User createUser(Id portalId, Auth.UserData data)
global void updateUser(Id userId, Id portalId, Auth.UserData data)
I have searched and cannot find the answer/explanation to the following question. I am implementing an Open Id Connect Auth Handler for SSO. When I looked through the debug logs when logging in using this auth provider, Salesforce knows which method to call. When I logged in for the first time, createUser(..) was called.
When I subsequently logged in, updateUser(Id userId, ...) was called. The userId was the Salesforce User Id. This measns that in context of our Registration handler, before the updateUser() method was called, Salesforce somehow matched the user to a Salesforce User and passed that Id as a parameter to the updateUser() method
My question is: In the authentication process, between accessing the UserInfo from the IdP and the Registration Handler method being called:
- How does Salesforce know which method to call between createUser / updateUser
- When the updateUser() is called, how does Salesforce match the user to a Salesforce User to resolve the userId.
Context: All new users will be registered using this SSO Reg. Handler. I would prefer using an external Id on User to store the Identifier from the IdP and then matching on this external Id to determine if the user exists or not. Based on the documentation, it does not seem like this is possible, and I am uncomfortable implementing the custom logic in the registration handler without understanding the mechanism that Salesforce uses to match UserInfo to a Salesforce User.
Can anyone provide an explanation on this mechanism?
