To use custom logic for user provisioning during SAML single sign-on, you must create a class that implements Auth.SamlJitHandler. This allows you to incorporate organization-specific logic (such as populating custom fields) when users log in to Salesforce with single sign-on. Keep in mind that your class must perform the logic of creating and updating user data as appropriate, including any associated account and contact records.
In Salesforce, you specify your class that implements this interface in the SAML JIT Handler field in SAML Single Sign-On Settings. Make sure that the user you specify to run the class has “Manage Users” permission.
The following are methods for SamlJitHandler.
public User createUser(Id samlSsoProviderId, Id communityId, Id portalId, String federationId, Map<String,String> attributes, String assertion)
Type: User
A User sObject.
The communityId and portalId parameter values may be null or an empty key if there is no community or portal configured with this organization.
public void updateUser(Id userId, Id samlSsoProviderId, Id communityId, Id portalId, String federationId, Map<String,String> attributes, String assertion)
Type: void
This is an example implementation of the Auth.SamlJitHandler interface. This code uses private methods to handle accounts and contacts (handleContact() and handleAccount()), which aren’t included in this example.
global class StandardUserHandler implements Auth.SamlJitHandler { private class JitException extends Exception{} private void handleUser(boolean create, User u, Map<String, String> attributes, String federationIdentifier, boolean isStandard) { if(create && attributes.containsKey('User.Username')) { u.Username = attributes.get('User.Username'); } if(create) { if(attributes.containsKey('User.FederationIdentifier')) { u.FederationIdentifier = attributes.get('User.FederationIdentifier'); } else { u.FederationIdentifier = federationIdentifier; } } if(attributes.containsKey('User.ProfileId')) { String profileId = attributes.get('User.ProfileId'); Profile p = [SELECT Id FROM Profile WHERE Id=:profileId]; u.ProfileId = p.Id; } if(attributes.containsKey('User.UserRoleId')) { String userRole = attributes.get('User.UserRoleId'); UserRole r = [SELECT Id FROM UserRole WHERE Id=:userRole]; u.UserRoleId = r.Id; } if(attributes.containsKey('User.Phone')) { u.Phone = attributes.get('User.Phone'); } if(attributes.containsKey('User.Email')) { u.Email = attributes.get('User.Email'); } //More attributes here - removed for length //Handle custom fields here if(!create) { update(u); } } private void handleJit(boolean create, User u, Id samlSsoProviderId, Id communityId, Id portalId, String federationIdentifier, Map<String, String> attributes, String assertion) { if(communityId != null || portalId != null) { String account = handleAccount(create, u, attributes); handleContact(create, account, u, attributes); handleUser(create, u, attributes, federationIdentifier, false); } else { handleUser(create, u, attributes, federationIdentifier, true); } } global User createUser(Id samlSsoProviderId, Id communityId, Id portalId, String federationIdentifier, Map<String, String> attributes, String assertion) { User u = new User(); handleJit(true, u, samlSsoProviderId, communityId, portalId, federationIdentifier, attributes, assertion); return u; } global void updateUser(Id userId, Id samlSsoProviderId, Id communityId, Id portalId, String federationIdentifier, Map<String, String> attributes, String assertion) { User u = [SELECT Id FROM User WHERE Id=:userId]; handleJit(false, u, samlSsoProviderId, communityId, portalId, federationIdentifier, attributes, assertion); } }