2

For the OpenId Connect pros out there:

Regarding the RegistrationHandler Interface in Salesforce. I have tried searching online for insight but I am having difficulty finding a specific answer for two scenarios:

  1. How are users matched to determine if the CreateUser() vs UpdateUser() method needs to be called?
  2. I logged into my org as a user and Salesforce prompted me to link Accounts. How did they identify the account to link. Similar to the image in this Question: Why would I use the "Existing User Linking URL" in an Authentication Provider.

Since I am a bit unsure of how to ask this properly, I will give the following example:

  1. I set up a SSO with google using OpenId using a Registration Handler to create/Update a User appropriately.'

    1a. I log into my org for the first time using my gmail account. I was prompted to link accounts to an existing Salesforce username. I linked it and I was logged in as existing user

    1b. I logged into my org as using a new gmail account [email protected] and a user was created successfully.

  2. I log out and Resign into the org using my gmail account: [email protected]

  3. Debug log shows that the updateUser(userId, portalId, userData) method was called and the userId in the debug log was the Salesforce Id.

I would typically think of setting up an External Id on the user record and populate it with the identifier provided by the Auth.UserData. Upon subsequent authentications, I would match Googles ID against my users to determine if a record needs to be created or already exists. This seems to happen automatically

To sum up my questions:

I am setting up an openID for an existing community that already has community users and users in the IdP. When they log in using SSO,

  1. (2A)Will they automatically be linked to the existing community user & what is the mechanism behind it
  2. Can I implement custom logic to match existing IdP users to their existing Salesforce Users using the IdP Identifier (external Id)?

While I am more familiar with SAML, curveball was thrown they use OpenId Connect.

Thank you

1 Answer 1

1

(2A)Will they automatically be linked to the existing community user & what is the mechanism behind it?

If the user logs in the first time, the answer is no, you need to have custom logic in your create user method to identify the existing user, for example using email address or other user info enter image description here

Can I implement custom logic to match existing IdP users to their existing Salesforce Users using the IdP Identifier (external Id)?

Not necessarily, once the user has logged in the first time (Email or any other user info as the identifier for the first time login), a ThirdPartyAccountLink record is created for this user, and IdP Identifier (external id) from openid scope will be automatically stored in RemoteIdentifier field, which will be used to identify the user from the second time log in and onwards as long as this TPAL is not revoked.enter image description here Third party account link on the user record page enter image description here

One TPAL is to link the user to one external IdP identifier, if one user has multiple accounts in the IdP provider, the user can have multiple TPAL records. As long as the user logs in with an external id stored in one of TPAL records, the new login attempt will match it. but if there is no TPAL record with this external id, it is like the first time login, the custom logic(Email or other user info) in createUser method will be used to match the user, if no user found, the new user account could be created.

Please find more in my blog article, basically, ThirdPartyAccountLink is used to link a user with an external id in an authentication provider, as long as the user has a ThirdPartyAccountLink record, the updateUser method will be called instead of createUser.

3
  • For one, this doesn't answer the question: there can be multiple ThirdPartyAccountLink (TPAL) records attached to the same user and even for already linked TPAL, the new login attempt may not match it. As a corollary to this comment, link-only answers are frowned upon. Link-only "look at my blog" answers are triple-frowned upon. It would be preferable to include the essential parts of the answer here, and provide the link for reference.
    – identigral
    Aug 25, 2022 at 16:26
  • 1
    Thanks @identigral for your advice and comment, I have updated my answers. One TPAL is to link the user to one external IdP identifier, if one user has multiple accounts in the IdP provider, the user can have multiple TPAL records. As long as the user logs in with an external id stored in one of TPAL records, the new login attempt will match it. but if there is no TPAL record with this external id, it is like the first time login, the custom logic(Email or other user info) in createUser method will be used to match the user, if no user found, the new user account could be created.
    – Jun Liu
    Aug 25, 2022 at 23:24
  • Thanks for the revision, looks better. Upvoted
    – identigral
    Aug 26, 2022 at 0:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .