I have a question about multiple connected Salesforce orgs via SSO. Is there a way to change the profile access for a user between multiple connected orgs through SSO? I have a scenario where Org1 is the identity provider and connected with Org2 as the Service Provider.
I have a user who is the Admin or Org1, but needs to be setup with Read Only access in Org2. Is there a way to modify his profile to be able to have the view from his Admin role in Org1 to a Read Only view in Org2?
The User record in each org for each user is independent and has a Profile defined on it directly.
If you have a user who is known in the IdP store as: [email protected], the configuration of the two orgs' User records for Joe might be configured like this:
Org 1 - Sales
Org: Acme Sales
Profile: System Administrator
Username: [email protected]
FederationId: [email protected]
Org 2 - Service
Org: Acme Service
Profile: Helpdesk Supervisor
Username: [email protected]
FederationId: [email protected]
The one consideration which you'll need to address comes into play with the just-in-time provisioning of users into an org if they don't exist there yet. The just-in-time provisioning SAML response will typically include the Profile which the user should have when they're created.
In the example above, if the SAML response for just-in-time provisioning indicated that Joe should be a System Administrator, and that was sent to the Service org - Joe's user record will be updated and his profile will/can be modified from Helpdesk Supervisor to System Administrator.
We have two distinct AD groups, that map to two separate custom domains:
For example:
SalesforceOrg1ProdSAdmin --> oursite1.my.salesforce.com
SalesforceOrg2ProdROnly --> oursite2.my.salesforce.com
When the user connects to the appropriate URL, it redirects using the appropriate AD settings.
