2

What could be the cause of error 18 - Invalid Account INVALID_ACCOUNT_ID as documented in Single Sign-On Implementation Guide?

Two use cases in our environment:

  1. User doesn't exist, Contact doesn't exist
  2. User doesn't exist, Contact does exist

SAML assertion where error occurred:

<AttributeStatement>
    <Attribute Name="User.Username" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="User.Username">
        <AttributeValue>foo@bar.com</AttributeValue>
    </Attribute>
    <Attribute Name="User.FirstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="User.FirstName">
        <AttributeValue>Fred</AttributeValue>
    </Attribute>
    <Attribute Name="User.LastName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="User.LastName">
        <AttributeValue>Foo</AttributeValue>
    </Attribute>
    <Attribute Name="User.Email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="User.Email">
        <AttributeValue>foo@bar.com</AttributeValue>
    </Attribute>
    <Attribute Name="User.ProfileID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="User.ProfileID">
        <AttributeValue>00e15000001J5Za</AttributeValue>
    </Attribute>
    <Attribute Name="Contact.Email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Contact.Email">
        <AttributeValue>foo@bar.com</AttributeValue>
    </Attribute>
    <Attribute Name="Contact.FirstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Contact.FirstName">
        <AttributeValue>Fred</AttributeValue>
    </Attribute>
    <Attribute Name="Contact.LastName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Contact.LastName">
        <AttributeValue>Foo</AttributeValue>
    </Attribute>
    <Attribute Name="Account.AccountNumber" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Account.AccountNumber">
        <AttributeValue>1496</AttributeValue>
    </Attribute>
    <Attribute Name="Account.Name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Account.Name">
        <AttributeValue>Acme Corp.</AttributeValue>
    </Attribute>
    <Attribute Name="Account.Owner" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Account.Owner">
        <AttributeValue>00515000007D9TH</AttributeValue>
    </Attribute>
</AttributeStatement>
1

The OP SAML assertion is for Use Case 2 - User doesn't exist, Contact does exist

The fundamental cause of the error is that the assertion contains values for an Account (specifically Account.AccountNumber=1496) that does not agree with the existing AccountNumber for the existing Contact foo@bar.com (whose parent Account.AccountNumber is null).

But more broadly, the real problem was using a one-size fits-all SAML assertion for both use cases (Contact doesn't already exist, Contact does exist).

Now, the documentation available to understand the JIT process is IMHO, somewhat contradictory.

The official JIT for Communities documentation states the matching rules looking for Contacts looks for matches under any supplied Account.AccountNumber.

However, the Knowledge Article on JIT Provisioning (SSO) states that Contacts are looked up based on email without considering their Account parent

What we ended up doing (and there's probably a better way)

  • Our IdP queries SFDC to see if a Contact already exists for a given email.
  • If YES, then the SAML assertion omits all Account.XXXX attributes.
  • If NO, then the SAML assertion also omits all Account.XXXX attributes and uses a configurable value for Contact.Account pointing at a generic, Community Account for newly-provisioned contacts/users. Out-of-band processes deal with moving these Contacts to existing Accounts (or creating new Accounts)

UPDATE An alternative would be to use an Apex SAML JIT Handler and apply your own logic to the values contained in the assertion (that is, bypass the SFDC matching rules and use your own)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.