I'm getting this error when I try to log in a user using SSO and JIT, the problem it's just with this user, i checked the assertion and the data, everything looks ok, same username and Federation Id. we have another user with the same email, do you think that could be a problem?

Thank you...

  • I'm getting that same error. When I used the "Existing User Linking URL" on the Auth. Provider setup, it created an entry under "Third-Party Account Links" on my user record with my Facebook Username (not an email address). That created the connection. Placing that value into the "Federation ID" didn't work at all. Were you able to find a solution? Commented Dec 11, 2013 at 20:48

1 Answer 1


Found a solution to this. Modify the createUser() method in the Auth Provider registration handler class to query for the user using the email address passed in the authentication (or any other query you want to use)

    if(!canCreateUser(data)) {
        // If the user has a Federation ID or username match, return that user
        // otherwise fail if can't create a new user
        if ([select count() from User WHERE FederationIdentifier = :data.email 
        OR Username = :data.email] == 0) {
            //Returning null or throwing an exception fails the SSO flow
            return null;
        } else {
            return [SELECT ID FROM User WHERE FederationIdentifier = :data.email 
            OR Username = :data.email LIMIT 1];

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .