1

I am familiar with and have successfully created a Communities user in Salesforce (acting as a SAML service provider (SP)) using Just-In-Time (JIT) provisioning when using a non Salesforce identity provider. When using JIT the attributes are being added to the SAML Assertion which requires an Identity Provider (IdP) to have generated an Assertion. This implies that a User must already exist in the Idenity Provider for it to generate an Assertion against that User. In my use case, I would like to have the user be generated in the IdP during the Web registration flow and then provisioned in the SP using JIT. In addition, I would like to have the forms all be in the web flow, not redirected to the IdP registration/login screen. With the given being that I am using Salesforce as the IdP and the SP. Is there a way to create the IdP user from the web flow. To clarify, by web flow, I mean a user coming in from a website (external to salesforce) but controlled by me. See below sequence diagram for referenceenter image description here

Improve this question
1
  • were you able to resolve this? Also is there a documentation on creating user in service Provider(salesforce) when the user is present in Identity Provider(salesforce)?
    – kanika Rana
    Commented Feb 1, 2017 at 2:47

1 Answer 1

Reset to default
1

In SAML terms Salesforce can function as both identity provider and a service provider.

Your web registration flow could act as a SAML identity provider and generate a SAML response targeting Salesforce. You will then be able to use JIT features of SF's SAML SP implementation. Historically JIT via SAML in SFDC hasn't been very flexible and therefore not a good choice for complex user account provisioning use cases. They're rolling out an improvement to this in Spring '15 with an ability to intercept the JIT call and inject logic in your own, custom ApEx class.

A more important question in your case is that of web registration flow. If (as your sequence diagram shows) this flow is going to reside outside of Salesforce, then you have two choices of how to provision the user account in Salesforce: call Salesforce APIs remotely (via SOAP/REST/etc) or use JIT via SAML. If your registration flow is going to be implemented as a set of screens residing at Salesforce, i.e. a standard scenario with registration pages in Visualforce with backing ApEx code, then your implementation is a simple set of calls to the APIs via ApEx.

Improve this answer
3
  • You made this comment: "Your web registration flow could act as a SAML identity provider and generate a SAML response targeting Salesforce. You will then be able to use JIT features of SF's SAML SP implementation."
    – John Considine
    Commented Feb 9, 2015 at 20:19
  • Thanks for the response. You made this comment: "Your web registration flow could act as a SAML identity provider and generate a SAML response targeting Salesforce. I would like to follow this route, however, I have tested and could not use JIT without a SAML Assertion. And I cannot get a SAML Assertion because Salesforce IdP does not have the user(it is a new user). So, in your comment if you are still using Salesforce as the IdP than I don't know how to make that work. If you know how to do this, please provide an example of how that can be accomplished.
    – John Considine
    Commented Feb 9, 2015 at 20:28
  • @JohnConsidine In your scenario your web registration flow/application could act as a SAML identity provider for the purpose of generating a SAML assertion. Salesforce would be a SAML service provider. Your web app would be generating a SAML assertion programmatically using whatever library/framework you feel comfortable with.
    – identigral
    Commented Feb 10, 2015 at 20:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .