1

SAML SSO to community is failing for users with error. I am using the Standard provisioning(not the custom JIT handler)

ErrorCode=5&ErrorDescription=Unable+to+create+user&ErrorDetails=PORTAL_USER_ALREADY_EXISTS_FOR_CONTACT+Api+Exception%3A+portal+user+already+exists+for+contact

SAML Assertion used:

<saml2:AttributeStatement>

      <saml2:Attribute Name="User.Email">
        <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                              xsi:type="xsd:anyType">somename@domain.com</saml2:AttributeValue>
      </saml2:Attribute>

      <saml2:Attribute Name="User.FirstName">
        <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                              xsi:type="xsd:anyType">some</saml2:AttributeValue>
      </saml2:Attribute>
      <saml2:Attribute Name="Contact.LastName">
        <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                              xsi:type="xsd:anyType">name</saml2:AttributeValue>
      </saml2:Attribute>
      <saml2:Attribute Name="User.ProfileId">
        <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                              xsi:type="xsd:anyType">00e1V000001ZGMp</saml2:AttributeValue>
      </saml2:Attribute>
      <saml2:Attribute Name="User.LastName">
        <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                              xsi:type="xsd:anyType">name</saml2:AttributeValue>
      </saml2:Attribute>
      <saml2:Attribute Name="Contact.Account">
        <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                              xsi:type="xsd:anyType">001f400000TbIxp</saml2:AttributeValue>
      </saml2:Attribute>
      <saml2:Attribute Name="User.Username">
        <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                              xsi:type="xsd:anyType">somename@domain.com</saml2:AttributeValue>
      </saml2:Attribute>
      <saml2:Attribute Name="Account.Name">
        <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                              xsi:type="xsd:anyType">Community Members Account</saml2:AttributeValue>
      </saml2:Attribute>
      <saml2:Attribute Name="Account.Owner">
        <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                              xsi:type="xsd:anyType">005f4000002kPDR</saml2:AttributeValue>
      </saml2:Attribute>
      <saml2:Attribute Name="Contact.Email">
        <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                              xsi:type="xsd:anyType">somename@domain.com</saml2:AttributeValue>
      </saml2:Attribute>
    </saml2:AttributeStatement>
  • This error usually occurs when the contact already exist in your org. Have you verified that the contact email and name are different than previously existing contacts? – CloudConnect Nov 30 '19 at 6:19
  • Both the contact and user already exists in my org. I am trying to login as an existing user (user created before saml sso was enabled). User creation using JIT works and it creates new contact, user (and this user can login again, no issues there). It's only not working for users created manually. – user1917034 Nov 30 '19 at 6:27
  • 2
    Check if the federation id is present on user or not if that is what configured in Single Sign on Settings. It could be possible that since the standard JIT did not find the user with the federation id it is trying to create one but with the same username it cannot create so that might be resulting to this error. – Kiran Machhewar Dec 1 '19 at 4:20
  • Yes. We don't have any Federation ID for any users. Once, I set the Federation ID for existing users, it's working fine. This documentation here (help.salesforce.com/…) is little confusing or not clear. Looks, If Federation ID is not present, salesforce assume it's a new user. I thought, if Federation ID doesn't match, the match should be based on username. – user1917034 Dec 2 '19 at 22:52
  • The behavior of standard JIT for communities is documented – identigral Dec 7 '19 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.