7al9w (7al9w) asked a question.
Salesforce Automated De-Provisioning - Doesn't seem to work with existing provisioned users
I'm testing the de-provisioning functionality with OKTA and Salesforce and want to confirm the expected behaviours and any potential work-arounds:
- It seems that turning on "Provisioning" funtionality for the Salesforce application changes the Assignment screen from a simple single-field form, to a multiple field form (including Profile, Role, Public groups, permission sets, etc.). This is confusing, as we only want to use the de-provisioning functionality to start with. We don't want OKTA to be having any control over these fields in Salesforce.
- After turning off provisioning functionality, this new assignment screen remains. It would be good to understand why these fields are presented (and how the options in them are being presented, even though there should be no link to our Salesforce instance with the provisioning switched off)
- SCENARIO - I assign a user to the application manually (and create their Salesforce user manually). I then switch on Provisioning. If I un-assign that user from the application, their Salesforce user isn't de-provisioned. Why is this? Is this expected behaviour? What is the difference between assigning an existing Salesforce user to the Salesforce OKTA application with Provisioning switched on/off. We have thousands of existing Users with OKTA assigments. Will we have to manually de-activate those users as they are un-assigned?
Chris,
Thank you for your response. You've clearly taken some time to respond, but I feel like I might not have been clear enough in some instances. With regards to the Profile mapping - I have removed all of the mappings from the "Profile Editor" for the application, but I still see all of the fields when I'm trying to assign a new user. Is that expected behaviour? Given that all the mappings are switched off, why are they still showing and what happens if I put data into those fields when assigning a user to the Salesforce application? I didn't clearly indicate enough that I had switched on the "De-provision" setting along with the "Provisioning" when I switched it on. The only tick-box I'd selected was "De-provision" and I left the rest un-ticked. I understand the differences between them and why we may only want to select particular parts of the functionality. The user who I tested on had been imported into OKTA already and had been assigned to the Salesforce application prior to me switching on the Provisioning functionality and enabling "De-Provision". Additionally, I had checked that the user was correctly mapped to the user in the Salesforce sandbox and they could log-in to the sandbox using OKTA. However, when I unassigned the user from the Salesforce application, their user in Salesforce was not de-activated. The de-provisioning only worked if I re-applied the Salesforce application to this user AFTER I had turned on the provisioning functionality. Your response indicates that this isn't expected behaviour. Is that the case? I'm not sure that I'm the target market for the OKTA Essentials course. I've been using OKTA for a number of years so am pretty comfortable with the broad functionality. My question relates more to this specific use case. With thanks,Andy