0

My situation here is that I want my Salesforce Digital Experience (AKA Community) to use an external identity provider that holds some custom access rights attributes that need to be transferred to Salesforce to influence what the Digital Experience presents. This is the Salesforce as a Service Provider case.

For SAML, it looks like hooking in an implementation of the SamlJitHandler that is passed all of the attributes of the SAML assertion will solve this problem.

But I don't see an equivalent ready to go mechanism for OAUTH. Is there one?

PS

Writing this question I just found this question Any way to get current session SSO information? that has an answer that points to the AuthProviderPluginClass. If you have experience with that do post an answer.

2
  • 1
    The answer you linked to still reflects the current state of the art. For OAuth and OpenID Connect (a superset of OAuth), another option is to make a callout to your external identity provider and hit the protocol-standard introspection and/or userinfo endpoint in the Login Flow. That might save you from writing a custom auth provider and/or dealing with protocol issues.
    – identigral
    Apr 28 '21 at 16:42
  • Thanks @identigral for the info.
    – Keith C
    Apr 28 '21 at 21:08
2

It depends a bit on your requirements. If your Identity provider can work with OpenIdConnect I would configure this as a Salesforce Auth. provider and then use a custom registration handler using the RegistrationHandler interface. This uses the login procedure to identify / create or update users on login. Salesforce documentation here

Then you can use the attributemap within the userdata variable can be used to retrieve any custom attributes that are being send with the request. This can then be used in any way you would like.

global User createUser(Id portalId, Auth.UserData data){ 
 String myCustomAttribute = data.attributeMap.get('custom_attribute')
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.