3

I've create the SSO server in which when logging in, Salesforce will takes care of

  1. Finding Account Specify

  2. Create the Contact

  3. Create the Community User Profile with that Contact.

    • Specify the Federation ID from the subject.
  4. Log the user into community.

What I have tried:

Success:

  1. User & Contact exists in Salesforce = Logging in with SSO directly to community

  2. Contact Exists but not User = Logging in with SSO directly to community

Failed:

  1. User & Contact does not exist in Salesforce = Salesforce uses SAML Attribute provided with the SAML Assertion from the SSO HTTP Post to find the source Account, create Contact and User.

Ref 1: https://help.salesforce.com/apex/HTViewSolution?id=000198728&language=en_US

Both the SSO production server and Ref 1 tutorial yield the same result. Which is

https://mycommunity.force.com/test/_nc_external/identity/saml/SamlError?ErrorCode=16&ErrorDescription=Unable+to+map+an+unique+profile+id+for+the+given+profile+name

But I have check again that the profile Id that we used in the attribute is actually a valid profile Id.

I have specify every attributes according to Ref 1 and still get the same error.

Any thoughts on what is missing?

  • try by passing the profile name instead of profileId – anmrk Sep 23 '14 at 4:58
  • @anmrk Already did that, got the same error - "Unable to map an unique profile id for the given profile name". – Chelman Sep 23 '14 at 5:32
  • which profileName you are trying to pass? – anmrk Sep 23 '14 at 6:17
  • Partner Community User Profile – Chelman Sep 23 '14 at 10:11
  • Here's the SAML assertion <saml2:Attribute FriendlyName="User.ProfileId" Name="User.ProfileId" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"> <saml2:AttributeValue xmlns:xsi=" http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Customer Community User</saml2:AttributeValue> </saml2:Attribute> – Chelman Sep 23 '14 at 10:22
3

I got this figured out.

Regarding Ref. 1: https://help.salesforce.com/apex/HTViewSolution?id=000198728&language=en_US

The tutorial suggested that we choose "Portal" instead of "Standard" for login option. But this is wrong! (Confirmed by Salesforce Engineer) Instead we need to leave it as "Standard" and pass the attributes specified in the tutorial and everything should work.

Here are some points to consider for JIT Provisioning SSO for Community User.

  1. Do not pass Federation ID (Contact.FederationID, User.FederationID) in the attribute statement. Passing Federation ID only on the SAML assertion subject is suffice.

  2. Do not pass Organization ID and Portal ID in the attribute statement.

  3. Recipient URL must be what specified by Salesforce under Single Sign-On settings.

  4. Issuer in Salesforce and on the Server must match.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.