Are there any other alternatives to Integrate AD with Salesforce without using Identity Connect?


It depends on what you're trying to accomplish.

If your goal is to have users sign in to SF with their AD credentials, you can implement single sign-on (SSO) via SAML or OpenID Connect using your favorite commercial or open source product. Commercial product - license is going to be more expensive vs Identity Connect. Open Source - if you can handle it, license will be zero but deployment/management/operation costs will be significant.

In this option you'd have to manage user accounts in SF on your own. For example, if a user's email address is changed or if a user is removed from AD you'll have to manually make this change in Salesforce by updating the user's email and/or deactivating their user account. (Salesforce does not allow user accounts to be deleted).

You can combine user account provisioning with SSO via SAML by using Just-in-Time (JIT) provisioning out of the box. You would use the payload of a SAML assertion to create OR update your users in Salesforce when they log in. (1st login = create, subsequent logins = update if needed). This eliminates the need to create user accounts in advance. The con of this approach is that you'll be limited to a very simple user account data model and you'll have very limited error handling. Also, you'll still need to manually remove/deactivate users from Salesforce when they're removed from AD. It might be good enough to start.

With automation of user provisioning as the goal, users and possibly groups or group-like entities would be synchronized between Salesforce and AD. This is a lot harder to achieve out of the box than single sign-on without provisioning. We haven't seen any identity administration/governance products (user provisioning is a subset of this) that can match the tailored feature set and have a cheaper license vs Identity Connect. There are a number of commercial identity management products (and a little bit of Open Source) that support automation of user provisioning. None of them are very good when it comes to dealing with Salesforce.

Out of the box, most of the identity management products talk to Active Directory, very few talk to Salesforce. These products are designed for the enterprise rather, thus license is going to be expensive. The out of the box feature set beyond basic user account sync is usually minimal to non-existent. Some of these products allow you to extend their functionality by building your own connector to, say, Salesforce. If it's an enterprise-wide deployment with Salesforce as one of many target applications supported by the identity management tool, building your own connector on the vendor's platform is a decent strategy. With Salesforce as the only target, this option is very expensive.

To summarize - if you're only solving for Salesforce/AD pair of source/target with respect to user accounts and related stuff, the only credible alternative to Identity Connect is rolling your own in whatever development stack/scripting language you're comfortable with.


Not the answer you're looking for? Browse other questions tagged or ask your own question.