7

As per the winter'14 feature OpenID Connect, I have successfully logged-in salesforce but I not getting enough user information like I was able to do in Facebook auth. While facebook auth provided a lot of info like name, emailId etc, OpenId Connect is only providing google id of that user.

Can anyone please confirm that I haven't done any mistake and suggest a way to get more info related to logged-in user ?

5

The data returned in an OpenID Connect request is dependent on the OAuth scope requested when the user logs in. This is configured on the "Default Scopes" field in the Auth. Provider record. For google, this is documented at https://developers.google.com/accounts/docs/OAuth2Login. Based on the scopes selected, Google prompts the user to accept request to share the data.

The minimum required scope you will need for Google based SSO is "openid". This will only provide you with the unique identifier for that Google user (it's the number shown in their Google+ profile.) The Auth.UserData object in the createUser / updateUser call will only include this in the "identifier" field.

UserData:[
    attributeMap={sub=000000000000000000000},
    email=null,
    firstName=null,
    fullName=null,
    identifier=000000000000000000000,
    lastName=null,
    link=null,
    locale=null,
    provider=Open ID Connect,
    siteLoginUrl=null,
    username=null
]

If you request the "email" and "openid" scopes, you will also get the email address of the user, the Google apps domain they use (if appropriate), and an email_verified flag (always seems to be true).

UserData:[
    attributeMap={
        email=example@example.com,
        email_verified=true,
        hd=example.com,
        sub=000000000000000000000
    },
    email=example@example.com,
    firstName=null,
    fullName=null,
    identifier=000000000000000000000,
    lastName=null,
    link=null,
    locale=null,
    provider=Open ID Connect,
    siteLoginUrl=null,
    username=null
]

Finally if you request "email", "openid" and "profile" scopes, you get much fuller details, as in the example below

UserData:[
    attributeMap={
        email=example@example.com,
        email_verified=true,
        family_name=Example,
        gender=male,
        given_name=Example,
        hd=example.com,
        locale=en-GB,
        name=Example Example,
        picture=https://lh4.googleusercontent.com/-7FGcUcrrm0w/AAAAAAAAAAI/AAAAAAAAAAA/3RsAZAmgtj0/photo.jpg,
        profile=https://plus.google.com/000000000000000000000,
        sub=000000000000000000000
    },
    email=example@example.com,
    firstName=Example,
    fullName=Example Example,
    identifier=000000000000000000000,
    lastName=Example,
    link=https://plus.google.com/000000000000000000000,
    locale=en-GB,
    provider=Open ID Connect,
    siteLoginUrl=null,
    username=null
]

Salesforce requests that the scopes be entered in alphabetical order without commas between them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.