<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D54z000082sQWkCAMOkta Classic EngineDirectoriesAnswered2022-09-14T06:17:16.000Z2022-09-07T09:43:10.000Z2022-09-14T06:17:16.000Z

jyosthnag.84789 (Customer) asked a question.

September 7, 2022 at 9:43 AM
Showing only few Salesforce options at okta

We use the OKTA IDP for Salesforce SSO.

 

What we discovered is that we can immediately onboard users to Salesforce from OKTA, which implies that a user is created in Salesforce from OKTA. This occurs when the user is assigned to an application in the OKTA. We are given a pop-up model to fill out in order to onboard the user to Salesforce.

 

What we need is assistance in restricting the Salesforce profile, permission sets, and public groups.

We do not want to display all salesforce profiles, permission sets, and public groups.

Set a default value to prevent user creations from OKTA.

  • 4 answers
  • 492 views

  • Mihai Negoita - Okta (Okta, Inc.)

    Thanks for the additional details.

    Unfortunately, that would not be something you can control from the Okta side. At best (although I doubt it), you might be able to configure that on the Salesforce side. Okta just does an API call to Salesforce for the information and displays the list based on the response received.

    If you can find a way to restrict what Salesforce sends, Okta would display only that info.

    That being said, this opens up the discussion of requirements: just hiding the info vs not using the info at all.

     

    My advise would be to check in with Salesforce Support as well.

    In the meantime, you can suggest a feature enhancement on the Okta Community page by going to the Community→ Ideas tab. Features suggested in our community are reviewed and can be voted and commented on by other members. High popularity will increase the likelihood of it being picked up by the Product Team and it being implemented.  

    More details here: 

    https://support.okta.com/help/s/blog/a674z000001cj7YAAQ/okta-ideas-faq?language=en_US

     

    Expand Post
    Selected as Best

  • Mihai Negoita - Okta (Okta, Inc.)

    Hi @jyosthnag.84789 (Customer)​ , Thank you for reaching out to the Okta Community!

     

    I'm not sure how much of this you have already configured, but please consult the following Salesforce Provisioning docs: 

     

    https://saml-doc.okta.com/Provisioning_Docs/Salesforce_Provisioning.html

     

    OR

     

    https://help.okta.com/en-us/Content/Topics/Provisioning/Salesforce/sfdc-enable-provisioning.htm

     

    Once you have all that configured as needed, you can grant specific permissions/roles/profiles etc via a Group assignment. 

    You can create a dedicated group or use a pre-existing Okta Group and assign it to the app. You will then be presented with the specifics of that assignment. From there you can decide what user to add to that group and if needed created/use other groups for a different mix of permissions.

     

    https://help.okta.com/oie/en-us/Content/Topics/Provisioning/lcm/lcm-assign-app-groups.htm

     

     

    If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

     

    Hope my answer helps! 

    --------------------------------

    The Okta Community Catalysts Program is now live. Collect online badges when you participate in the Okta Help Center Questions community. Learn more here.

    Expand Post

    • jyosthnag.84789 (Customer)

      I have done the all the configuration as above mentioned and created a group and assigned application and users to the group

       

      imageIn the application i have configured the required access

      need assistance in restricting the options in the profile field:

      profile url and public groups fields are from salesforce , we don't want to show all the options under these fields. do we have the control to restrict these options

      image

      Expand Post

  • Mihai Negoita - Okta (Okta, Inc.)

    Thanks for the additional details.

    Unfortunately, that would not be something you can control from the Okta side. At best (although I doubt it), you might be able to configure that on the Salesforce side. Okta just does an API call to Salesforce for the information and displays the list based on the response received.

    If you can find a way to restrict what Salesforce sends, Okta would display only that info.

    That being said, this opens up the discussion of requirements: just hiding the info vs not using the info at all.

     

    My advise would be to check in with Salesforce Support as well.

    In the meantime, you can suggest a feature enhancement on the Okta Community page by going to the Community→ Ideas tab. Features suggested in our community are reviewed and can be voted and commented on by other members. High popularity will increase the likelihood of it being picked up by the Product Team and it being implemented.  

    More details here: 

    https://support.okta.com/help/s/blog/a674z000001cj7YAAQ/okta-ideas-faq?language=en_US

     

    Expand Post
    Selected as Best
This question is closed.
Loading
Showing only few Salesforce options at okta