What is the right saml assertion for the Salesforce Role from Okta JIT

Loading

Skip to Navigation Skip to Main Content

Search

Search

Select Language

0D54z00007mQG7ICAWOkta Classic EngineSingle Sign-OnAnswered2024-04-16T12:55:15.000Z2022-07-05T16:51:17.000Z2022-07-07T23:28:46.000Z

ii126 (ii126) asked a question.

July 5, 2022 at 4:51 PM

What is the right saml assertion for the Salesforce Role from Okta JIT

I have setup Okta and Salesforce JIT. And, I am wanting to pass the Role assertion with the right role but does not seem to work. I have tried user.Role "Sales", User.RoleId "Sales", User.RoleID "Sales" and I get the following error: "We can't log you in because of an issue with single sign-on. Contact your Salesforce admin for help." Although, User.CompanyName "Test" works but the Role does not. Thanks for your help.

Top Rated Answers

ii126 (ii126)
4 years ago
This was the right attribute for the Salesforce role within Okta. User.UserRoleId. And this is the query you need to execute in Salesforce "Select u.Alias, u.Name, u.CompanyName, u.UserRoleId, u.UserRole.Id, u.UserRole.Name from User u WHERE u.Alias LIKE 'alias'" in order to get the different values.
Expand Post
Selected as Best

All Answers

Mihai Negoita - Okta (Okta, Inc.)
4 years ago
Hi @ii126 (ii126) , Thank you for reaching out to the Okta Community!

If you are using the Salesforce Provisioning feature, the role attribute should be already available in the attribute schema.
You can check it under Okta Admin Dashboard→ Directory→ Profile Editor→ Salesforce:

If you are not using the Provisioning feature, you'll have to check on the Salesforce side what the expected variable values are and ensure you have the value populated in the user's Okta Profile. The variable name is "role", as see in the above screenshot.
In the below screenshot you have an example of how the setup should look like. Where "user.role" makes reference to the value each individual user has populated under their Okta Profile.

More info on the subject can be found here:
https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-user-profile-attributes-main.htm?cshid=ext_Directory_Manage_Profile_Attributes

If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.

Hope it helps!
Expand Post
ii126 (ii126)
4 years ago
Thank you very much Mihai, I am working in another instance for salesforce for our sales people and we need to enable JIT User Provisioning otherwise is going to eat our licensing. I just need to pass the Role "Sales" and I am good to go. I did not set up provisioning. See screenshots. Thoughts ?
Image is not available
Image is not available
Image is not available
Expand Post
- Mihai Negoita - Okta (Okta, Inc.)
  4 years ago
  Ok, so if you do not use Provisioning the Mappings side of this does not matter/apply as it's not being used. Only the Attribute statements matter.
  If the value for the attribute is the same for all users, you can go with a simple string value of "Sales". This has to match the exact name of the role in Salesforce, so check the list of roles on that side. For example, my (default) Salesforce implementation does not list "Sales" as a valid role value. It lists things like CEO, COO, CFO, Channel Sales Team and so on but no Sales.
  
  The name of the attribute should be just "role" (no quotes).
  Example:
  Expand Post
ii126 (ii126)
4 years ago
Thanks Mihai. Your inputs were valuable. I think I got it. Wow, I almost give up. I just realized that this cloud stuff requires some basic dev skills to understand the different endpoints. I just asked the requester to test. I will post more tomorrow. You were right in checking the Salesforce side in finding how the "Role" is seen within Salesforce Dev environment. More later....
Expand Post
ii126 (ii126)
4 years ago
This was the right attribute for the Salesforce role within Okta. User.UserRoleId. And this is the query you need to execute in Salesforce "Select u.Alias, u.Name, u.CompanyName, u.UserRoleId, u.UserRole.Id, u.UserRole.Name from User u WHERE u.Alias LIKE 'alias'" in order to get the different values.
Expand Post
Selected as Best
ii126 (ii126)
4 years ago
Ohh and I used the following links to research, understand and accomplish my goal.
Okta Expression Language overview: https://developer.okta.com/docs/reference/okta-expression-language/#okta-user-profile
Configure Salesforce as the Service Provider with SAML Single Sign-On: https://help.salesforce.com/s/articleView?id=sf.sso_saml.htm&type=5
Just-in-Time Provisioning Requirements and SAML Assertion Fields: https://help.salesforce.com/s/articleView?id=sf.sso_jit_requirements.htm&type=5
Introduction to SOQL and SOSL: https://developer.salesforce.com/docs/atlas.en-us.soql_sosl.meta/soql_sosl/sforce_api_calls_soql_sosl_intro.htm
Getting Started with Apex: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_intro_get_started.htm
Salesforce Developer Console Basics: https://trailhead.salesforce.com/content/learn/modules/developer_console
Salesforce Quick Start, Apex: https://trailhead.salesforce.com/content/learn/projects/quickstart-apex
Expand Post

This question is closed.

Recommended content

Forum

What is the reason for Unable to JIT error

Forum

Unable to Validate Incoming SAML Assertion: The attribute InResponseTo ID--- in the SAML response did not match any SAML request id previously sent to the Identity Provider.

Forum

Remove empty SAML attributes from assertion

Forum

WHERE do I get the SAML assertion for OKTA like this one from AWS https://signin.aws.amazon.com/static/saml-metadata.xml

Loading

What is the right saml assertion for the Salesforce Role from Okta JIT