For the OpenId Connect pros out there:

Regarding the RegistrationHandler Interface in Salesforce. I have tried searching online for insight but I am having difficulty finding a specific answer for two scenarios:

  1. How are users matched to determine if the CreateUser() vs UpdateUser() method needs to be called?
  2. I logged into my org as a user and Salesforce prompted me to link Accounts. How did they identify the account to link. Similar to the image in this Question: Why would I use the "Existing User Linking URL" in an Authentication Provider.

Since I am a bit unsure of how to ask this properly, I will give the following example:

  1. I set up a SSO with google using OpenId using a Registration Handler to create/Update a User appropriately.'

    1a. I log into my org for the first time using my gmail account. I was prompted to link accounts to an existing Salesforce username. I linked it and I was logged in as existing user

    1b. I logged into my org as using a new gmail account user@gmail.com and a user was created successfully.

  2. I log out and Resign into the org using my gmail account: user@gmail.com

  3. Debug log shows that the updateUser(userId, portalId, userData) method was called and the userId in the debug log was the Salesforce Id.

I would typically think of setting up an External Id on the user record and populate it with the identifier provided by the Auth.UserData. Upon subsequent authentications, I would match Googles ID against my users to determine if a record needs to be created or already exists. This seems to happen automatically

To sum up my questions:

I am setting up an openID for an existing community that already has community users and users in the IdP. When they log in using SSO,

  1. (2A)Will they automatically be linked to the existing community user & what is the mechanism behind it
  2. Can I implement custom logic to match existing IdP users to their existing Salesforce Users using the IdP Identifier (external Id)?

While I am more familiar with SAML, curveball was thrown they use OpenId Connect.

Thank you

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.