1

Struggeling to Authenticate to Microsoft AD With Open ID Connect using Named Credentials/External Credentials.

First of all: This approach works on all Salesforce Instances, now I have this issue on a single Customer-Sandbox.

My Auth Provider:

enter image description here

Following things were done:

  • Added Client Id / Secret from Connected App within Microsoft AD
  • Added Callback URL to Connected App within Microsoft AD

My External Credentials

enter image description here

The User has Access through Permissionset for following two things:

  1. All Permisions for "User External Credential" Object
  2. Permission for the Principal in External Credential (External Credential Principal Access)

Execution

After this, the User is able to start the authentication flow through his User Settings:

enter image description here

This Flow successfully authenticated the User at Microsoft AD and finally redirects user to Callback URL. At this point i allways get following:

enter image description here

In the URL there is following ErrorCode:

AuthorizationError?ErrorCode=Existing_link&startURL=XXXX

Sadly this ErrorCode is not mentioned by Salesforce: https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_flow_errors.htm&language=en_US&type=5

This approach works perfectly on several Salesforce instances, only not on this specific one. What I've compared with working Salesforce Instances:

  • Sessions Settings
  • IP Restrictions

Does anybody experienced same? How to get the root cause for "Existing_Link"? I got somewhere at StackExchange, that this ErrorCode is raised if no Access to "User External Credential" is granted. But this Permission is granted.

Any suggestion?

Improve this question
3
  • How to get the root cause for "Existing_Link : learn and understand the OpenID Connect protocol, then reproduce the calls using command-line tools. You might be able to explain the issue then. Or you can try your luck by opening a support case.
    – identigral
    Commented Nov 9, 2023 at 17:54
  • @identigral don't think so, sorry for that. Since MS redirects me, withouth any Exception and Salesforce just swallows the exception, I don't see any chance - even with command line - that salesforce will provide a different information.. It says "I dont like it, but i do not say why".
    – TheShadow
    Commented Nov 10, 2023 at 6:52
  • The error is produced by SF based on what MS sends. Yes, it's possible that this is SF-specific and independent of MS but that is unlikely. Therefore doing this on command-line is going to help. Even if you can't reproduce it on command-line, merely by trying you'd gain a lot more understanding of what's going on.
    – identigral
    Commented Nov 10, 2023 at 7:23

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .