4

I have a below scenario,

Lets say i have implemented SSO for Salesforce and IDp lets say is some .Net based Webservice which implements SAML 2.

When user tried to authenticate, He was active in IDp as well as in SP. He was succesfully able to authenticate Salesforce1 app using OAuth (After SAML based login succeeded).

However, after few day he got deactivated from IDp and still active in Service Provider (Salesforce).

As he is still active in Salesforce and OAuth is already setup, he can access his Salesforce1 application.

How should i check or revoke his access once he is not active in Identi provider ?

Please suggest.

  • 1
    I have the exact same scenario, except I'm using (another) Salesforce as IdP, great question. – greenstork Apr 17 '14 at 18:10
  • As user is deactivated in IDP, shouldnt it fail in authentication itself? Are you using SP initiated authentication? – Prasanna Apr 18 '14 at 10:34
  • Hi @eprasu , User is deactivated from IDp after Authorization. User is Still active in SP and SP already have valid OAuth token for Salesforce1 app. – Jitendra Zaa Apr 18 '14 at 10:49
  • 1
    Can you configure the IdP to make a callout when the user is deactivated? If so, you could deactivate the user in Salesforce which would (I think) revoke their OAuth tokens too. – metadaddy Apr 18 '14 at 15:13
  • Thanks for reply pat, but what callout should i make from IDP? Is it to service provider or some other URL ? – Jitendra Zaa Apr 18 '14 at 15:16
2

After discussion with @metadaddy and @cmort, only solution I found was to make callout from IdP to Service Provider to remove OAuth token or deactivate user. I have written one blog article also which includes this scenario, hope it will help others. Section "Testing Scenario 4".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.