We’re rewarding the question askers & reputations are being recalculated! Read more.
18

No need for an API. Just use synchronous Apex code instead. Simply create and insert a User in a try and check for the right exception in the catch and always rollback the insert in the finally. This class should do the job. public class UserService { public static Boolean existsName(String fullUserName) { Boolean result = false; User ...


14

The User Agent (UA) and Web Server (WS) flows have two different security purposes. The main difference is that UA is used for untrusted clients, while WS is used for a server application; the WS uses a Client Secret (CS) as an extra authorization parameter to prevent spoofing servers. The reason for this is that if a server is compromised, everyone using ...


7

you could either use the REST API curl https://<INSTANCE>.salesforce.com/services/data/v20.0/query/?q=SELECT+email+,+name+,+roleid+from+User -H "Authorization: Bearer token" for details see http://www.salesforce.com/us/developer/docs/api_rest/Content/dome_query.htm or you can run a SOQL query against the SOAP API using your access token for the ...


7

We use Salesforce as an Identity Provider for SSO into our Customer Portal. We use a Sites domain to isolate the sessions - so that users' own org sessions are not clobbered by logging in to our portal. I have written up what we did here: http://foobarforce.com/2012/12/07/salesforce-identity-provider-for-portal/ There may be enough overlap with what you ...


6

In Summer '13 (safe harbor!) you will be able to build that page by simply enumerating AppMenuItem records from Visualforce.


6

You have to sign up for a new developer org(https://developer.salesforce.com). After this goto setup and search profiles. You can see this


5

Yes, you are correct. Customer Community License is for Business-to-consumer communities with large numbers of external users. This decision tree will help you to choose correct license type. For more information, refer Communities User Licenses You can do small poc on the same and verify the license count upon navigating Company Information page, after ...


5

Looks like you pretty much have covered all the steps an admin can perform to configure salesforce as an Identity provider. He can update the custom attributes to be sent back as part of assertion, but is limited to available dropdown options provided by Salesforce (Mentioned in your question). However, there is a possible way to extend the custom attribute ...


4

I suspect your apex won't be run if there will be a timeout (meaning that for all practical purposes you can treat UserInfo.getSessionId() as never null). Can you wrap your methods in client-side check? var currentTime=new Date().getTime(); var sessionTimeLeft=secondsLeftValue-((currentTime-lastPageActivityTime)/1000); alert(sessionTimeLeft); It's based ...


4

You may be in luck. There's something call the ExperienceID or expid that potentially could be used to do what you want to achieve. Its primary purpose is to be able to customize the "branding experience" for customers depending on where they are sent to your community from. You can learn more about it by reading this link to the Salesforce External ...


3

External Identity User licenses are available at an extra cost. Contact your AE for pricing. Five External Identity User licenses are included in standard DEs.


3

Users cannot be deleted from a Salesforce org, the user would be deactivated.


3

SCIM is in pilot. Email cmortimore@salesforce.com to have it enabled in your org.


3

Salesforce changed the way adding a service provider worked with the Winter 14 release and made it substantially more complicated. Here is documentation that I found that describes the process: https://help.salesforce.com/apex/HTViewHelpDoc?id=identity_provider_examples.htm&language=en


3

You can always have admins login using direct URL even when the Prevent login from ... is enabled. The way to do so is to append a query parameter login in the login URL (example below) where admins can still use their Salesforce username and password. https://mydomain.my.salesforce.com/?login You can find more details here. It's advisable that you expire ...


2

This feature is included in the Winter '14 release.


2

I think you'll find the answers to your question in these two posts here on SF.SE: Basic SSO concepts and how Salesforce fits in and SSO with OAuth for Communities. The first post asks questions very close to yours and receives some fairly specific answers that I think you'll find helpful while the second is more general. The resources provided as links are ...


2

This usually has to do with the Entity ID field being incorrect in the Service Provider's Single Sign-On Configuration. Make sure it's the Service Provider's domain URL, not the Identity Provider's domain URL. (Which is kind of confusing because, why would you be entering the URL of the org you are already in? But that's how it is...) This refers to step 5....


2

If it has a valid signature, that means the public key used to validate it corresponds to the private key that it was signed with.


2

Finally I figured it out. Looks like the identity provider and the certificate are used for other services. If you try to login to your org from any third party service provide, salesforce will behave as Identity provider for this custom domain URL. In simple words, you can disable the Identity Provider and your domain login will still work. Hope this ...


2

You are asking this question so you know that OAuth is used to grant an application access to Salesforce as a specific user. This application can be a server application (e.g. workbench, docusign) or client app (e.g. browser based app, mobile app). Distinction between these are client app's source code is distributed, server application's source code is ...


2

The actual login process is as follows: User goes to a My Domain (something.my.salesforce.com). My Domain sends the user to Identity Connect via SAML. Identity Connect verifies the user's identity against Active Directory. Identity Connect sends the user to the Salesforce login with a SAML assertion. Salesforce validates the SAML assertion and gives the ...


2

Yes, what you want to do can be done. You want to see the External Identity Documentation. In particular Dynamic Branding Using Custom Login Pages and Extend an Endpoint with the Experience ID. The latter will be the technique you'll need to use to provide the unique branding experience for each external app.


1

After you install Napili template, these are the custom Lightning component that are added to your org. If you open any of these components on Developer console, you should see a commented tag: Line 1: <!-- add implements="forceCommunity:availableForAllPageTypes" to surface the component in community builder --> For SelfRegister form component: ...


1

According to me, it is identity provider initiated flow. User is already logged in into Salesforce after authentication from LDAP. After that, user is trying access links of Customer Community, so it already has user authentication information (SAML assertion) which is ready to pass to Service Provider. Also, refer Identity Providers and Service ...


1

There could be some other simple way to achieve this but i think one possible way could be by extending ConnectedAppPlugin class.Here you can restrict access.See below image where you can provide this extended class.This option is available on connected app. See this link for more info: ConnectedAppPlugin Class


1

I'll answer my own question. This is part of the Winter 2016 Salesforce release.


1

The Service Providers are not shown any more under the Service Providers section when looking at an Identity Provider. They are only listed in the Connected Apps section. I don't think it's a bug, they just decided to have them only at that other location. Note that this screenshot coming from the Implementing Single Sign-On Across Multiple Organizations ...


1

No, While using rest api it is mandatory to pass the session id / token in headers as passing it in query string will be very high security risk.


Only top voted, non community-wiki answers of a minimum length are eligible