Certified Identity and Access Management Designer

By Salesforce · Question Mode

QuestionQ23

VerifiedAccepting 3rd Party Identity in Salesforce

An Architect has successfully configured SAML-based SSO for Universal Containers. SSO has operated successfully for 3 months when Universal Containers manually adds a batch of new users to Salesforce. The new users receive an error from Salesforce when they attempt to use SSO. Existing users can still successfully use SSO to access Salesforce.

What is the likely cause of this behavior?

Explanation

SAML single sign-on identifies a Salesforce user by matching the identifier sent in the SAML assertion to the user record’s configured identity value. When Federation ID is used, each new user’s FederationIdentifier must be populated correctly and match the value asserted by the identity provider. An absent or mismatched Federation ID prevents Salesforce from locating the new user, while previously mapped users continue to authenticate successfully.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!