Get user's info on login into Salesforce org with OpenID Connect

Question

As per the winter'14 feature OpenID Connect, I have successfully logged-in salesforce but I not getting enough user information like I was able to do in Facebook auth. While facebook auth provided a lot of info like name, emailId etc, OpenId Connect is only providing google id of that user.

Can anyone please confirm that I haven't done any mistake and suggest a way to get more info related to logged-in user ?

Answer 1

The data returned in an OpenID Connect request is dependent on the OAuth scope requested when the user logs in. This is configured on the "Default Scopes" field in the Auth. Provider record. For google, this is documented at https://developers.google.com/accounts/docs/OAuth2Login. Based on the scopes selected, Google prompts the user to accept request to share the data.

The minimum required scope you will need for Google based SSO is "openid". This will only provide you with the unique identifier for that Google user (it's the number shown in their Google+ profile.) The Auth.UserData object in the createUser / updateUser call will only include this in the "identifier" field.

UserData:[
    attributeMap={sub=000000000000000000000},
    email=null,
    firstName=null,
    fullName=null,
    identifier=000000000000000000000,
    lastName=null,
    link=null,
    locale=null,
    provider=Open ID Connect,
    siteLoginUrl=null,
    username=null
]

If you request the "email" and "openid" scopes, you will also get the email address of the user, the Google apps domain they use (if appropriate), and an email_verified flag (always seems to be true).

UserData:[
    attributeMap={
        [email protected],
        email_verified=true,
        hd=example.com,
        sub=000000000000000000000
    },
    [email protected],
    firstName=null,
    fullName=null,
    identifier=000000000000000000000,
    lastName=null,
    link=null,
    locale=null,
    provider=Open ID Connect,
    siteLoginUrl=null,
    username=null
]

Finally if you request "email", "openid" and "profile" scopes, you get much fuller details, as in the example below

UserData:[
    attributeMap={
        [email protected],
        email_verified=true,
        family_name=Example,
        gender=male,
        given_name=Example,
        hd=example.com,
        locale=en-GB,
        name=Example Example,
        picture=https://lh4.googleusercontent.com/-7FGcUcrrm0w/AAAAAAAAAAI/AAAAAAAAAAA/3RsAZAmgtj0/photo.jpg,
        profile=https://plus.google.com/000000000000000000000,
        sub=000000000000000000000
    },
    [email protected],
    firstName=Example,
    fullName=Example Example,
    identifier=000000000000000000000,
    lastName=Example,
    link=https://plus.google.com/000000000000000000000,
    locale=en-GB,
    provider=Open ID Connect,
    siteLoginUrl=null,
    username=null
]

Salesforce requests that the scopes be entered in alphabetical order without commas between them.