0

We have two communities - Partner Community and Customer community. we need a Partner community user to login into customer community. These two already exists in Production. A user can be part of both communities. so, they are creating separate User records with respective licenses. Now they need SSO, for a Partner user to login into customer community. While implementing this facing an issue. Error 'Unable to map the subject to a Salesforce.com user. Subject: 00DXXXXXXXXXXXX@p1@sf.com' I have mentioned Partner's username as Federation Id of Customer user's record.

Below is the SAML validator results :

Unexpected Exceptions
Ok 1. Validating the Status
Ok
2. Looking for an Authentication Statement
Ok
3. Looking for a Conditions statement
Ok
4. Checking that the timestamps in the assertion are valid
Ok
5. Checking that the Attribute namespace matches, if provided
Not Provided
6. Miscellaneous format confirmations
Ok
7. Confirming Issuer matches
Ok
8. Confirming a Subject Confirmation was provided and contains valid timestamps
Ok
9. Checking that the Audience matches
Ok
10. Checking the Recipient
Ok
Organization Id that we expected: 00Dxxxxxx
Organization Id that we found based on your assertion: 00Dxxxxxx
11. Validating the Signature
Is the response signed? true
Is the assertion signed? true
Is the correct certificate supplied in the keyinfo? true
Ok
12. Checking that the Site URL Attribute contains a valid site url, if provided
Not Provided
13. Looking for portal and organization id, if provided
Not Provided
14. Checking if session security level is valid, if provided
Ok

Subject: 00Dxxxxxxxxx@user@sf.com
Unable to map the subject to a Salesforce.com user

AssertionId: _4c68d3bd54c7dc23c88744fc7adb40f81546421056960

1

Instead of SSO you can create a permission set and assign them to user which need to access multiple communities and then add that permission set into community group member.

As per docs:

Grant or remove access for groups of users. Once you add a profile or permission set, all users assigned to that profile or permission set become members of the community.

Add Members to Your Community

  • Initially, we proposed this permission set solution but there are some problems by this approach. So we have decided go forward with SSO. – Pavanaja Y Jan 2 at 9:41
0

Instead of username, i was able to create connection by UserId/any custom field. It worked, was successfully able to login to customer community.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.