1

I have received a requirement to build a custom LWC used for verifying the users identity which is then embedded in a flow. In case the user can verify his or her identity the flow proceeds.

Now I have built the verification using Salesforce's SOAP Api leveraging the login() interface where the user enters the login and password and the login() interface returns a session id in case the login was successful. That works fine.

Now there is a new requirement to enable the verification using SSO. The customer uses ADFS (Active Directory Federated Service) as it the Identity Provider.

Is it possible to pass the login credentials in the SAML AuthNRequest? If so how would the outgoing message look like?

Is there any other way to verify the users SSO credentials in Salesforce?

3
  • 1
    Why would you need to verify the user's s credentials if they are already logged in the platform? Or are you referring to a public page in a community (using Digital Experiences)? Dec 5, 2023 at 11:51
  • 1
    The flow starts a quality assurance process which requires the already logged in user to verify his or her identity. You can think of it as a signature. The logged in user fills in some data and wants to confirm them by entering the login credentials so that it is one hundred percent certain that the person logged in executed the quality assurance. Dec 5, 2023 at 12:22
  • With SSO, you'll have a bad time attempting this because Salesforce chose not to support a key part of SAML protocol that allows you to force reauthentication. The only workaround as of this writing is to log the user out. Without SSO, while you can verify the password as the answer below recommends, it's more nuanced than that if you want a secure solution. Look into assurance levels tied to the session and do a search here for relevant Q&As.
    – identigral
    Dec 5, 2023 at 18:19

1 Answer 1

0

I'm not sure if it is possible complete this requirement for SSO credentials with custom code.

You can, however, leverage the UserManagement class instead of calling the SOAP API for verifying the user's password. You can use UserManagement.verifyVerificationMethod for that:

Auth.VerificationResult res = UserManagement.verifyVerificationMethod(
    null,
    'the user password as string',
    Auth.VerificationMethod.PASSWORD
);
System.debug(res.success); // true or false

This method allows you to verify the user's identity using email, password, authenticator, SMS or TOTP or the password. Email and SMS are considered unsafe, but the others are ok to use.

Note: the documentation for this class doesn't provide any guidance on using SSO, hence why I think your requirement is not feasible at this time.

1
  • Thanks for letting me know. I wasn't aware of this class. From my understanding I need to craft an SAML AuthNRequest and send it via a POST Request to the IDP. Dec 5, 2023 at 12:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .