I am using SAML assertion to retrieve an OAuth token and I am using a custom apex class to generate the SAML assertion. My IDP is set to send User's FederationIdentitfier in Subject (SAML Response Pic), but in my Apex code where I am posting this SAML response to token end point, if I modify the SUBJECT to "4499", I am getting some timeout error.

Should the SUBJECT be User's 'username' only?

SAML Response


Should the SUBJECT be User's 'username' only?

Yes, based on the documentation for OAuth 2.0 SAML Bearer Assertion Flow, this needs to be username (emphasis mine):

The Subject NameID must be the username of the desired Salesforce user.

  • Hey Jayant, thanks for answering my question. Actually I have 2 service provider orgs, SP1 and SP2 and I have obtained my SAML response from IDP into SP1. Now, in order to connect SP1 and SP2 I am using the oauth SAML response from SP1 and posting it to oAuth token end point (which is a connected app in SP2). Now, if I have to put user's username is the Subject (in SP1), then which user would that be SP1 user or SP2 user? because these 2 username's are different only the federationId is common. – ShruthiKy Apr 8 at 16:02
  • @ShruthiKy Comments are meant for follow ups on the question. But in this case, you have a completely different question in your comments. You should open this as a new question for someone to be able to help you on that specific issue. The answer here was specific to your original question based on the format of SFSE. – Jayant Das Apr 8 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.