User and group management
The Salesforce Connector links users and groups from the data store to Salesforce. The behavior of each provisioning capability is described below.
Synchronizing existing users
The provisioning connector synchronizes users from the data store to Salesforce based on the Username
attribute.
To set up synchronization, use the SP Connection → Configure Channels → Channel → Attribute Mapping screen to populate the Username
attribute with a matching attribute from the data store.
For example:
-
In Salesforce, Janet’s
Username
isjsmith@example.com
. -
In your data store, Janet’s
mail
isjsmith@example.com
. -
On the Attribute Mapping screen, you map the
Username
attribute tomail
. -
When the provisioning connector runs, the data store user is provisioned with a
Username
ofjsmith@example.com
. That matches Janet’s existingUsername
in Salesforce, so her information in the data store is synchronized to her Salesforce account.
User provisioning
Triggered by any of the following:
-
A user is added to the data store group or filter that is targeted by the provisioning connector.
-
A user with "disabled" status is added to the data store group or filter that is targeted by the provisioning connector, and the Provision disabled users provisioning option is enabled.
The target is determined by the Source Location screen in the provisioning connector configuration.
User updates
Triggered when a change occurs to a user attribute that is mapped in the provisioning connector configuration.
User deprovisioning
Triggered by any of the following:
-
A user is deleted from the user store.
-
A user is disabled in the user store.
-
A user is removed from the data store group or filter that is targeted by the provisioning connector.
The provisioning connector disables or freezes the user depending on whether Freeze users instead of disable is selected. See Provisioning options reference.
Synchronizing existing groups
The provisioning connector synchronizes groups from the data store to Salesforce based on the group name.
For example:
-
In Salesforce, there is a group is named
Accounting
. -
In your data store, there is a group with a
CN
ofAccounting
. -
When the provisioning connector runs, the two groups are synchronized.
Group provisioning
Triggered when a group is added to the data store filter that is targeted by the provisioning connector.
The target is determined by the Source Location screen in the provisioning connector configuration.
Group name updates
Renaming the group in the data store will trigger PingFederate to rename the group in Salesforce.
Group membership updates
Changing group memberships through the group’s properties or a user’s properties will trigger PingFederate to update the group membership in Salesforce.
Group memberships in the data store overwrite the group memberships in Salesforce.
Group deletion
Triggered by any of the following:
-
Deleting the group in the data store will trigger PingFederate to delete the group in Salesforce. Group deletions are permanent and cannot be undone.
-
The group is removed from the data store group or filter that is targeted by the provisioning connector.