19

No need for an API. Just use synchronous Apex code instead. Simply create and insert a User in a try and check for the right exception in the catch and always rollback the insert in the finally. This class should do the job. public class UserService { public static Boolean existsName(String fullUserName) { Boolean result = false; User ...


15

The User Agent (UA) and Web Server (WS) flows have two different security purposes. The main difference is that UA is used for untrusted clients, while WS is used for a server application; the WS uses a Client Secret (CS) as an extra authorization parameter to prevent spoofing servers. The reason for this is that if a server is compromised, everyone using ...


8

Looks like you pretty much have covered all the steps an admin can perform to configure salesforce as an Identity provider. He can update the custom attributes to be sent back as part of assertion, but is limited to available dropdown options provided by Salesforce (Mentioned in your question). However, there is a possible way to extend the custom attribute ...


7

you could either use the REST API curl https://<INSTANCE>.salesforce.com/services/data/v20.0/query/?q=SELECT+email+,+name+,+roleid+from+User -H "Authorization: Bearer token" for details see http://www.salesforce.com/us/developer/docs/api_rest/Content/dome_query.htm or you can run a SOQL query against the SOAP API using your access token for the ...


6

You have to sign up for a new developer org(https://developer.salesforce.com). After this goto setup and search profiles. You can see this


6

In Summer '13 (safe harbor!) you will be able to build that page by simply enumerating AppMenuItem records from Visualforce.


5

Yes, you are correct. Customer Community License is for Business-to-consumer communities with large numbers of external users. This decision tree will help you to choose correct license type. For more information, refer Communities User Licenses You can do small poc on the same and verify the license count upon navigating Company Information page, after ...


5

You may be in luck. There's something call the ExperienceID or expid that potentially could be used to do what you want to achieve. Its primary purpose is to be able to customize the "branding experience" for customers depending on where they are sent to your community from. You can learn more about it by reading this link to the Salesforce External ...


4

This usually has to do with the Entity ID field being incorrect in the Service Provider's Single Sign-On Configuration. Make sure it's the Service Provider's domain URL, not the Identity Provider's domain URL. (Which is kind of confusing because, why would you be entering the URL of the org you are already in? But that's how it is...) This refers to step 5....


3

You are asking this question so you know that OAuth is used to grant an application access to Salesforce as a specific user. This application can be a server application (e.g. workbench, docusign) or client app (e.g. browser based app, mobile app). Distinction between these are client app's source code is distributed, server application's source code is ...


3

External Identity User licenses are available at an extra cost. Contact your AE for pricing. Five External Identity User licenses are included in standard DEs.


3

SCIM is in pilot. Email cmortimore@salesforce.com to have it enabled in your org.


3

Salesforce changed the way adding a service provider worked with the Winter 14 release and made it substantially more complicated. Here is documentation that I found that describes the process: https://help.salesforce.com/apex/HTViewHelpDoc?id=identity_provider_examples.htm&language=en


3

Users cannot be deleted from a Salesforce org, the user would be deactivated.


3

You can always have admins login using direct URL even when the Prevent login from ... is enabled. The way to do so is to append a query parameter login in the login URL (example below) where admins can still use their Salesforce username and password. https://mydomain.my.salesforce.com/?login You can find more details here. It's advisable that you expire ...


2

If it has a valid signature, that means the public key used to validate it corresponds to the private key that it was signed with.


2

This feature is included in the Winter '14 release.


2

I think you'll find the answers to your question in these two posts here on SF.SE: Basic SSO concepts and how Salesforce fits in and SSO with OAuth for Communities. The first post asks questions very close to yours and receives some fairly specific answers that I think you'll find helpful while the second is more general. The resources provided as links are ...


2

No, While using rest api it is mandatory to pass the session id / token in headers as passing it in query string will be very high security risk.


2

Finally I figured it out. Looks like the identity provider and the certificate are used for other services. If you try to login to your org from any third party service provide, salesforce will behave as Identity provider for this custom domain URL. In simple words, you can disable the Identity Provider and your domain login will still work. Hope this ...


2

The actual login process is as follows: User goes to a My Domain (something.my.salesforce.com). My Domain sends the user to Identity Connect via SAML. Identity Connect verifies the user's identity against Active Directory. Identity Connect sends the user to the Salesforce login with a SAML assertion. Salesforce validates the SAML assertion and gives the ...


2

If Salesforce is Service Provider then My Domain is mandatory to be setup. Otherwise SP initiated flow will not work. Where as, if Salesforce is Identity Provider then it could nice to setup My Domain, IdP initiated flow will work perfectly. My Domain is required before you can use these Salesforce features: Single sign-on (SSO) with external identity ...


2

Yes, what you want to do can be done. You want to see the External Identity Documentation. In particular Dynamic Branding Using Custom Login Pages and Extend an Endpoint with the Experience ID. The latter will be the technique you'll need to use to provide the unique branding experience for each external app.


2

It is Keylogging and Phishing. Because these other attacks can be avoided with different ways - Dictionary attack This can be avoided by using complex password policies and a number of attempts. With Salesforce, in the session setting, you can configure same policies. Man-in-the-middle attack This is more concerned related to network security than the ...


2

The OpenID Connect protocol in brief: The RP (Client) sends a request to the OpenID Provider (OP). The OP authenticates the End-User and obtains authorization. The OP responds with an ID Token and possibly an Access Token. The RP can send a request with the Access Token to the UserInfo Endpoint. The UserInfo Endpoint returns Claims about the End-User. In ...


1

According to me, it is identity provider initiated flow. User is already logged in into Salesforce after authentication from LDAP. After that, user is trying access links of Customer Community, so it already has user authentication information (SAML assertion) which is ready to pass to Service Provider. Also, refer Identity Providers and Service ...


1

The header you are setting in GET request is not proper. it should be Authorization instead of oauth_token. According to SF docs: To call the doGet method from a client, open a command-line window and execute the following cURL command to retrieve an account by ID: curl -H "Authorization: Bearer sessionId" "https://instance.salesforce.com/yourURL" ...


1

You simply have to set the NameID and SessionIndex Attribute from the SSO Login Assertion in the Logout Request as well. I can see from your Logout Request that you are not doing this, so you get the status:Responder which is a slight hint that something went wrong. If you miss those values Salesforce will not know which Session to terminate.


1

After you install Napili template, these are the custom Lightning component that are added to your org. If you open any of these components on Developer console, you should see a commented tag: Line 1: <!-- add implements="forceCommunity:availableForAllPageTypes" to surface the component in community builder --> For SelfRegister form component: ...


1

There could be some other simple way to achieve this but i think one possible way could be by extending ConnectedAppPlugin class.Here you can restrict access.See below image where you can provide this extended class.This option is available on connected app. See this link for more info: ConnectedAppPlugin Class


Only top voted, non community-wiki answers of a minimum length are eligible