For the OpenId Connect pros out there:
Regarding the RegistrationHandler Interface in Salesforce. I have tried searching online for insight but I am having difficulty finding a specific answer for two scenarios:
- How are users matched to determine if the CreateUser() vs UpdateUser() method needs to be called?
- I logged into my org as a user and Salesforce prompted me to link Accounts. How did they identify the account to link. Similar to the image in this Question: Why would I use the "Existing User Linking URL" in an Authentication Provider.
Since I am a bit unsure of how to ask this properly, I will give the following example:
I set up a SSO with google using OpenId using a Registration Handler to create/Update a User appropriately.'
1a. I log into my org for the first time using my gmail account. I was prompted to link accounts to an existing Salesforce username. I linked it and I was logged in as existing user
1b. I logged into my org as using a new gmail account [email protected] and a user was created successfully.
I log out and Resign into the org using my gmail account: [email protected]
Debug log shows that the updateUser(userId, portalId, userData) method was called and the userId in the debug log was the Salesforce Id.
I would typically think of setting up an External Id on the user record and populate it with the identifier provided by the Auth.UserData. Upon subsequent authentications, I would match Googles ID against my users to determine if a record needs to be created or already exists. This seems to happen automatically
To sum up my questions:
I am setting up an openID for an existing community that already has community users and users in the IdP. When they log in using SSO,
- (2A)Will they automatically be linked to the existing community user & what is the mechanism behind it
- Can I implement custom logic to match existing IdP users to their existing Salesforce Users using the IdP Identifier (external Id)?
While I am more familiar with SAML, curveball was thrown they use OpenId Connect.