In Salesforce, when configuring an Auth. Provider, we can create and customize a Registration Handler Class implementing this interface

there are two methods that need to be implemented:

global User createUser(Id portalId, Auth.UserData data)

global void updateUser(Id userId, Id portalId, Auth.UserData data)

I have searched and cannot find the answer/explanation to the following question. I am implementing an Open Id Connect Auth Handler for SSO. When I looked through the debug logs when logging in using this auth provider, Salesforce knows which method to call. When I logged in for the first time, createUser(..) was called.

When I subsequently logged in, updateUser(Id userId, ...) was called. The userId was the Salesforce User Id. This measns that in context of our Registration handler, before the updateUser() method was called, Salesforce somehow matched the user to a Salesforce User and passed that Id as a parameter to the updateUser() method

My question is: In the authentication process, between accessing the UserInfo from the IdP and the Registration Handler method being called:

  1. How does Salesforce know which method to call between createUser / updateUser
  2. When the updateUser() is called, how does Salesforce match the user to a Salesforce User to resolve the userId.

Context: All new users will be registered using this SSO Reg. Handler. I would prefer using an external Id on User to store the Identifier from the IdP and then matching on this external Id to determine if the user exists or not. Based on the documentation, it does not seem like this is possible, and I am uncomfortable implementing the custom logic in the registration handler without understanding the mechanism that Salesforce uses to match UserInfo to a Salesforce User.

Can anyone provide an explanation on this mechanism?

1 Answer 1


Salesforce creates a link automatically when creating user. When you go to the User Page (via Setup) to a User who has logged in via the Auth Provider/SSO, you'll see there is a link in Third-Party Account Links. There you'll find with which Auth Provider the user logged in and what his/her identifier is in the system which you connected with Salesforce.

I think (so not 100% sure) that Salesforce reacts on this link. When it recognizes the unique identifier in a link, it will use 'updateUser' and also has the Salesforce User Id via the link, if there is no existing link, it will start 'createUser'.

  • 1
    Thanks for the response. I deduced this as well and had tested it out. it seems this is not documented in much detail anywhere
    – Z33dawg
    Commented Nov 1, 2021 at 17:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .