I have written Just in Time (JIT) controller to handle JIT scenarios. Azure is passing the Identity provider details. But in salesforce, all values like below showing null, despite those are in the SAML request received.

     attributes.containsKey('User.displayname') are null
     attributes.containsKey('User.mail') are null

when I printed attributes it does not have those values.

Below is part of SAML received:

<Attribute Name="http://schemas.microsoft.com/identity/claims/tenantid">
<Attribute Name="http://schemas.microsoft.com/identity/claims/objectidentifier">
<Attribute Name="http://schemas.microsoft.com/identity/claims/displayname">
<Attribute Name="http://schemas.microsoft.com/identity/claims/identityprovider">
<Attribute Name="http://schemas.microsoft.com/claims/authnmethodsreferences">
<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">

Below are attributes values I have printed in logs.

USER_DEBUG [174]|DEBUG|Printing Attributes{http://schemas.microsoft.com/claims/authnmethodsreferences=urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, http://schemas.microsoft.com/identity/claims/displayname=TEST_APIPORTAL, http://schemas.microsoft.com/identity/claims/identityprovider=https://sts.windows.net/2bb82c64-2eb1-43f7-8862-abgdfdf678/, http://schemas.microsoft.com/identity/claims/objectidentifier=085fc16b-532d-4f4b-9ba6-ebea6b93c53fytr, http://schemas.microsoft.com/identity/claims/tenantid=2b876

  • Your SAML assertion does not have User.displayname or User.mail. Take a look at Debug & Run Diagnostics trailhead and learn how to use a debug log. Had you done so, you would have been able to send the method parameters your JIT handler received to the log and see the names of attributes. – identigral Apr 13 at 16:09
  • Thanks for quick reply identigral. I am little confused in my Saml Assertion there are attributes with displayname and name for example --Attribute Name="schemas.xmlsoap.org/ws/2005/05/identity/claims/name"> <AttributeValue>TEST_APIPORTAL@abc.com</AttributeValue> </Attribute> – David Mycka Apr 13 at 18:44
  • Where does it say User.displayname – identigral Apr 13 at 18:49
  • Oh ok, I thought since attribute has value Name and displayname, so I can use it. I guess I need to decode assertion passed by salesforce using Base64 decoder and then I can parse and read it. Correct? In below method for JIT handler --> global User createUser(Id samlSsoProviderId, Id communityId, Id portalId, String federationIdentifier, Map < String, String > attributes, String assertion) .. salesforce is passing assertion. – David Mycka Apr 13 at 18:56
  • 1
    It's already parsed and decoded for you. Map <String, String> attributes has what you're looking for. – identigral Apr 13 at 19:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.