#Auth Provider0 personne en discute

Recommendation, when facing User Provisioning Error from Microsoft Entra ID to Salesforce:

I recently faced an issue with the user provisioning integration from Microsoft Entra ID to Salesforce. The error response is seen at the bottom (all included for enabling searching of this by others). 

Issue Origin:

The issue was caused by a duplicate user being created:

1. Proper 'User Real' already existed, without FederationIdentifier
2. Then the user provisioning system synchronized the users to Salesforce
3. Since it didn't find a user with the FederationIdentifier, it created a new one 'User Dupe'
4. We found this, deactivated 'User Dupe' and cleared FederationIdentifier, and set the correct one on 'User Real'
5. However, the next user provisioning sync failed.
6. The error message was unclear, but we found the user facing the issue based on a Salesforce User ID in the Entra ID provisioning error logs.
7. We then tried to set some dummy FederationIdentifier on 'User Dupe' and tried a sync, and then we got a different error.

Probable Root Cause: 

While one might assume that Microsoft Entra ID always retrieves users from Salesforce, before an update occurs towards Salesforce, it instead seems like Entra ID is caching a table of users based on Salesforce user ids, and updates based on this invalid cache mapping (FederationIdentifier -> SF User Id). 

The bug overall seems to be in Microsoft Entra ID, so the issue should be raised with their support.

EntrySynchronizationError

• Result: Failure
• Description: Failed to match an entry in the source and target systems User 'XX@YY.ZZ'
• ErrorCode: UnSpecified
• Error details: Invalid context
• ErrorMessage: 

An error has occurred when attempting to match an entry in the source and target systems. 

Review the common matching failures and error details for more information. Common matching failures: 

• The target application does not support filtering on the matching attribute. Review your attribute mappings and ensure that the target application supports filtering on that matching attribute.
• The source entry does not have a value for at least one matching attribute. Review your attribute mappings to identify the matching attribute(s) and ensure that the entry has a value for those attribute(s).
• The target application denied the request due to an authentication or authorization failure. Ensure that the credentials you have provided have the necessary permissions for provisioning.
• There is an issue with the target application. It is unreachable, returned a non-specific error, or returned a non-SCIM compliant response. Contact the application developer. 

#User Provisioning #Auth Provider #Error

@Itzik Koren @Matt Bahrenburg @Chuck Mortimore 

We ran into a documented issue where Auth. Providers don't refresh their access tokens unless a previous callout returned http 401. There's a large pool of potential integration partners within Czech banks that, unfortunately, return 403 as a response to an expired access token.

To my horror, they're following an API blue print (they've all agreed upon) that mandates to return 403 as a specific response in this case.

I put together an idea to make it configurable when an Auth. Provider refreshes the token: https://success.salesforce.com/ideaView?id=0873A000000CXzjQAG and would like to run it past you to gather some more feedback before mobilizing the community. (The idea's about the custom Apex-based Auth. Provider but I trust the same limitation applies to the standard ones too.)

Currently, the solution we have is more a workaround using old-school VF page-based OAuth dance + custom settings instead of a proper Auth. Provider + Named Credential. It has a few drawbacks, too, I don't really like for the purpose.

Would be really happy to know your opinion on a case like this and if there's perhaps something like that on the roadmap.

Thank you!

#OAuth #AuthProvider #AuthProviderPluginClass 

Auth. Provider allows the specification of User Info Endpoint URL. If this URL is specified, would Salesforce get user info automatically from the endpoint and pass it to the registration handler as parameters? 

Reference: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_auth_plugin.htm

• Interface: Auth.RegistrationHandler
• Method: global User createUser(Id portalId, Auth.UserData data)
• Data structure: 

           Auth.UserData(String identifier,

                                    String firstName,

                                   String lastName,

                                   String fullName,

                                   String email,

                                   String link,

                                   String userName,

                                   String locale,

                                   String provider,

                                   String siteLoginUrl,

                                   Map<String, String> attributeMap)

Thanks for answering! 

Cross-posting from @Unlocked Packages 

I have a package that has some Auth Providers in it (source at the end of the post). When first developed I created the Auth Provider in a scratch org then pulled the source with force:source:pull and all was running smoothly. Now it seems I'm not able to push this package anymore to any other scratch org.

After executing the first force:source:push to a new scratch org I get an error with the message "You must enter a value" for the Auth Providers. This is only in the first push thou, the following push commands just don't seem to detect any result since returns a "No results found" message.

So I have 2 problems here:

* Something seems to be missing from the Auth Provider even though I initially created it in a scratch org and pulled its source.

* After first failed push, following ones don't even try to push the Auth. Providers (and related Named Credentials) again, like if they didn't exist.

Have anyone faced a similar issue?

https://github.com/jonathanwiesel/RepoExplorer

---

Update: I've reviewed the AuthProvider documentation from the Metadata API

https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_authproviders.htm

And it seems that for OpenIdConnect provider types some information is mandatory that the force:source:pull didn't retrieve from the scratch org (defaultScopes and userInfoUrl). I tried specifying directly in the source XML then push it to the scratch org but it seems something is still missing (although with this the second issue disappears, it does try to push it every time instead of only the first).