4

I have a below scenario,

Lets say i have implemented SSO for Salesforce and IDp lets say is some .Net based Webservice which implements SAML 2.

When user tried to authenticate, He was active in IDp as well as in SP. He was succesfully able to authenticate Salesforce1 app using OAuth (After SAML based login succeeded).

However, after few day he got deactivated from IDp and still active in Service Provider (Salesforce).

As he is still active in Salesforce and OAuth is already setup, he can access his Salesforce1 application.

How should i check or revoke his access once he is not active in Identi provider ?

Please suggest.

Improve this question
7
  • 1
    I have the exact same scenario, except I'm using (another) Salesforce as IdP, great question.
    – greenstork
    Apr 17, 2014 at 18:10
  • As user is deactivated in IDP, shouldnt it fail in authentication itself? Are you using SP initiated authentication?
    – Prasanna
    Apr 18, 2014 at 10:34
  • Hi @eprasu , User is deactivated from IDp after Authorization. User is Still active in SP and SP already have valid OAuth token for Salesforce1 app.
    – Jitendra Zaa
    Apr 18, 2014 at 10:49
  • 1
    Can you configure the IdP to make a callout when the user is deactivated? If so, you could deactivate the user in Salesforce which would (I think) revoke their OAuth tokens too.
    – metadaddy
    Apr 18, 2014 at 15:13
  • Thanks for reply pat, but what callout should i make from IDP? Is it to service provider or some other URL ?
    – Jitendra Zaa
    Apr 18, 2014 at 15:16

1 Answer 1

Reset to default
2

After discussion with @metadaddy and @cmort, only solution I found was to make callout from IdP to Service Provider to remove OAuth token or deactivate user. I have written one blog article also which includes this scenario, hope it will help others. Section "Testing Scenario 4".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .