@Salesforce Identity @CTA Study Group 1111 I'm trying to solve the puzzle:
We would like to keep separate User provisioning and user Authentication via OpenId.
1. We create a user in SF.
2. We want this user to be able to login into SF via OpenId Auth Provider.
How we can match this OpenId user with existing SF User?
In registration handler class this user login will always drop into createUser method. In createUser method there is no way to create ThirdPartyLink record for existing user.
Am I correct?
Does this mean, if we have a corporate scenario when we want to provision users into SF upfront, and next let them sign in with OpenId Auth Provider we need to let them login with SF credentials first and use "Existing User Linking URL"?
That would mean in such scenario I cannot use OpenId type of Auth provider but only SAML?
@Mohit Sharma @Lawrence Newcombe any help please?
@Utathya Roy in my case, I'm considering corporate OpenIdc provider (not FB or Linkedin or anything like that). My IdP returns attributes which can be used to match with a user created in the system already. In my case, IdP username matches with SF Username. But it can also be any employee Id or any other Federated Id which in createUser method can be matched with any User attribute.
