Skip to main content
21 votes
Accepted

Is there any API that allows me to check if a Username is in use?

No need for an API. Just use synchronous Apex code instead. Simply create and insert a User in a try and check for the right exception in the catch and always rollback the insert in the finally. ...
Robert Sösemann's user avatar
21 votes
Accepted

Pros and cons of user-agent flow vs web server flow

The User Agent (UA) and Web Server (WS) flows have two different security purposes. The main difference is that UA is used for untrusted clients, while WS is used for a server application; the WS uses ...
sfdcfox's user avatar
  • 495k
10 votes
Accepted

Dynamically adding custom attributes to SAML response

Looks like you pretty much have covered all the steps an admin can perform to configure salesforce as an Identity provider. He can update the custom attributes to be sent back as part of assertion, ...
Salesforcesmarty's user avatar
6 votes

"External Identity User" Profile not available

You have to sign up for a new developer org(https://developer.salesforce.com). After this goto setup and search profiles. You can see this
Amjad khan's user avatar
6 votes

Pros and cons of user-agent flow vs web server flow

Coming back to answer my own question. The answers above were true at the time but IETF no longer recommends using User Agent at all. As well, Web Server flows have been updated to not require a ...
brezotom's user avatar
  • 1,087
5 votes

Can a Login Flow know which Connected App started it?

You may be in luck. There's something call the ExperienceID or expid that potentially could be used to do what you want to achieve. Its primary purpose is to be able to customize the "branding ...
crmprogdev's user avatar
5 votes
Accepted

Salesforce IDP for external users

Yes, you are correct. Customer Community License is for Business-to-consumer communities with large numbers of external users. This decision tree will help you to choose correct license type. For ...
Santanu Boral's user avatar
5 votes
Accepted

"Unable to resolve request into a Service Provider" return by Salesforce Identity Provider for SAML 2.0 request

This usually has to do with the Entity ID field being incorrect in the Service Provider's Single Sign-On Configuration. Make sure it's the Service Provider's domain URL, not the Identity Provider's ...
ceiroa's user avatar
  • 1,029
4 votes
Accepted

Disable forgot password for SSO Users

You can always have admins login using direct URL even when the Prevent login from ... is enabled. The way to do so is to append a query parameter login in the login URL (example below) where admins ...
Jayant Das's user avatar
  • 30.6k
4 votes

Pros and cons of user-agent flow vs web server flow

You are asking this question so you know that OAuth is used to grant an application access to Salesforce as a specific user. This application can be a server application (e.g. workbench, docusign) or ...
user1270665's user avatar
3 votes
Accepted

Is Custom Domain required in SF when implementing SSO where SF is the Service Provider?

If Salesforce is Service Provider then My Domain is mandatory to be setup. Otherwise SP initiated flow will not work. Where as, if Salesforce is Identity Provider then it could nice to setup My ...
Santanu Boral's user avatar
3 votes
Accepted

"External Identity User" Profile not available

External Identity User licenses are available at an extra cost. Contact your AE for pricing. Five External Identity User licenses are included in standard DEs.
Christian Carter's user avatar
2 votes
Accepted

Salesforce autentication with active directory

The actual login process is as follows: User goes to a My Domain (something.my.salesforce.com). My Domain sends the user to Identity Connect via SAML. Identity Connect verifies the user's identity ...
sfdcfox's user avatar
  • 495k
2 votes

Add custom claims to OpenID Connect id token - Web Server Authentication flow

I found a way to include custom attributes in the JWT token from the Connected App programatically. Connected App plugin: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/...
andres.bravo's user avatar
2 votes

Add custom claims to OpenID Connect id token - Web Server Authentication flow

Your understanding is correct. Out of the box, you can receive an OpenID Connect id token if you request openid scope but you have limited control over non-standard claims in this token. If you need ...
identigral's user avatar
  • 7,661
2 votes

Add custom claims to OpenID Connect id token - Web Server Authentication flow

You may be able to set custom claims via the JWT Class if you are creating your own Authentication Provider in Salesforce.
Bryan Anderson's user avatar
2 votes
Accepted

Alternate VisualForce page for OAuth Web Server flow

Yes, what you want to do can be done. You want to see the External Identity Documentation. In particular Dynamic Branding Using Custom Login Pages and Extend an Endpoint with the Experience ID. The ...
crmprogdev's user avatar
2 votes
Accepted

Salesforce as an OpenID Connect provider with Azure B2C as a Relying Party

The OpenID Connect protocol in brief: The RP (Client) sends a request to the OpenID Provider (OP). The OP authenticates the End-User and obtains authorization. The OP responds with an ID Token and ...
identigral's user avatar
  • 7,661
2 votes
Accepted

What types of attacks does Salesforce Multi Factor Authentication (MFA) prevent?

It is Keylogging and Phishing. Because these other attacks can be avoided with different ways - Dictionary attack This can be avoided by using complex password policies and a number of attempts. With ...
Ysr Shk's user avatar
  • 3,157
2 votes

Receiving custom attributes from an external identity provider using OAUTH for SSO?

It depends a bit on your requirements. If your Identity provider can work with OpenIdConnect I would configure this as a Salesforce Auth. provider and then use a custom registration handler using the ...
Jowin Waaijer's user avatar
2 votes

Is is possible to use Salesforce as an Identity provider for community license users?

Yes, this is possible. For every experience cloud site you use, it can act as an IDP. This includes external users linked to the site. Here are the steps to enable communities as IDP, note it is very ...
Mohith Shrivastava's user avatar
2 votes
Accepted

Asset's Record Type can't be deleted because it's used by Identity User profile

The solution is very similar to the one described in the post linked in Swetha's comment, which was originally posted by Karanraj Sankaranarayanan. I'll copy it here and change some things, as some ...
kwojt's user avatar
  • 66
2 votes

SAML - difference between Identity Type and Identity Location

So, basically what is going on here is the following: SAML Identity Location - identifies within the XML of the SAML assertion where the service provider will find the user's identity as provided by ...
cropredy's user avatar
  • 71.9k
1 vote
Accepted

Does NetworkMember solve the problem of assigning the Network Id in Communities/Experiences?

I checked in my current org as we do assign users to multiple communities and the query below select NetworkId from NetworkMember where select MemberId = :UserInfo.getUserId() Returns a row for ...
Kris Goncalves's user avatar
1 vote

Does NetworkMember solve the problem of assigning the Network Id in Communities/Experiences?

Yes, NetworkMember solves the problem of which users are part of a given Community/Experience. However it is technically possible to add the same profiles, permission sets, and users on multiple ...
Jeferson Chaves's user avatar
1 vote

Passing context/state to a SAML service provider

In SAML, RelayState is used for passing state between identity and service provider. In identity provider-initiated flow, you construct the link by taking the value of IdP-initiated Login URL field ...
identigral's user avatar
  • 7,661
1 vote
Accepted

Seamless Sign On - Single Sign On

You may need to go to My Domain and make sure the only authentication method checked is your Single Sign On configuration, and that login is unchecked. This will force Salesforce to try ...
IllusiveBrian's user avatar
1 vote

Seamless Sign On - Single Sign On

That's a feature of the IdP, not Salesforce. You will need to configure the IdP to control how sessions are authenticated. For example, in our org, the IdP will reauthenticate automatically within ...
sfdcfox's user avatar
  • 495k
1 vote

Field Service Lightning Mobile App Extension URL Global Parameters

To clarify your question, what you want to open is an App that runs from within Salesforce Mobile using using an extension from the FSL App. What you're asking to do is supported on iOS. However, you ...
crmprogdev's user avatar
1 vote
Accepted

Need Single Sign on related clarification

According to me, it is identity provider initiated flow. User is already logged in into Salesforce after authentication from LDAP. After that, user is trying access links of Customer Community, so ...
Santanu Boral's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible