5

I've create the SSO server in which when logging in, Salesforce will takes care of

  1. Finding Account Specify

  2. Create the Contact

  3. Create the Community User Profile with that Contact.

    • Specify the Federation ID from the subject.

  4. Log the user into community.

What I have tried:

Success:

  1. User & Contact exists in Salesforce = Logging in with SSO directly to community

  2. Contact Exists but not User = Logging in with SSO directly to community

Failed:

  1. User & Contact does not exist in Salesforce = Salesforce uses SAML Attribute provided with the SAML Assertion from the SSO HTTP Post to find the source Account, create Contact and User.

Ref 1: https://help.salesforce.com/apex/HTViewSolution?id=000198728&language=en_US

Both the SSO production server and Ref 1 tutorial yield the same result. Which is

https://mycommunity.force.com/test/_nc_external/identity/saml/SamlError?ErrorCode=16&ErrorDescription=Unable+to+map+an+unique+profile+id+for+the+given+profile+name

But I have check again that the profile Id that we used in the attribute is actually a valid profile Id.

I have specify every attributes according to Ref 1 and still get the same error.

Any thoughts on what is missing?

Improve this question
6
  • try by passing the profile name instead of profileId
    – anmrk
    Commented Sep 23, 2014 at 4:58
  • @anmrk Already did that, got the same error - "Unable to map an unique profile id for the given profile name".
    – Chelman
    Commented Sep 23, 2014 at 5:32
  • which profileName you are trying to pass?
    – anmrk
    Commented Sep 23, 2014 at 6:17
  • Partner Community User Profile
    – Chelman
    Commented Sep 23, 2014 at 10:11
  • Here's the SAML assertion <saml2:Attribute FriendlyName="User.ProfileId" Name="User.ProfileId" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"> <saml2:AttributeValue xmlns:xsi=" http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Customer Community User</saml2:AttributeValue> </saml2:Attribute>
    – Chelman
    Commented Sep 23, 2014 at 10:22

1 Answer 1

Reset to default
6

I got this figured out.

Regarding Ref. 1: https://help.salesforce.com/apex/HTViewSolution?id=000198728&language=en_US

The tutorial suggested that we choose "Portal" instead of "Standard" for login option. But this is wrong! (Confirmed by Salesforce Engineer) Instead we need to leave it as "Standard" and pass the attributes specified in the tutorial and everything should work.

Here are some points to consider for JIT Provisioning SSO for Community User.

  1. Do not pass Federation ID (Contact.FederationID, User.FederationID) in the attribute statement. Passing Federation ID only on the SAML assertion subject is suffice.

  2. Do not pass Organization ID and Portal ID in the attribute statement.

  3. Recipient URL must be what specified by Salesforce under Single Sign-On settings.

  4. Issuer in Salesforce and on the Server must match.

Improve this answer
2
  • 1
    This was very good advice - changing to Standard did the trick. The docs are SO BAD.
    – Caspar Harmer
    Commented Aug 6, 2020 at 21:51
  • This helped me. Thanks!
    – DobotJr
    Commented Feb 21 at 0:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .