Provisioning
The Salesforce connector supports provisioning, allowing you to create and manage accounts and entitlements in Salesforce directly from SailPoint.
Prerequisite: Your system is configured for provisioning.
When SailPoint provisions new accounts to the source, it uses the attributes on the Create Account page as instructions or a template for what to include in the account. This page is also referred to as the provisioning policy.
When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.
For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.
Important
This section describes the default Create Account configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.
Note
The Generator default is Disabled.
Default Create Account Attributes
| Attribute | Description |
|---|---|
| Alias | (Required) The eight-character alias. By default, it generates a value based on the lastname and firstname in the field's inline script. It takes the first seven characters from the last name and prefixes it with the first character of the first name. |
| IsActive | Indicates the active status of the account. Defaults to true, meaning the account is active. |
| Username | Defaults to the account's username. |
| Defaults to the account's email address. | |
| FirstName | Defaults to the account's first name. |
| Lastname | Defaults to the account's last name. |
| CommunityNickname | Nickname defaults to account's full name. |
| TimeZoneSidKey | The user's timezone, it uses a display name defined by Salesforce. Only a few timezones are defined in the policy drop down and this will need to be customized for each deployment. Defaults to America/Los_Angeles. |
| LocaleSidKey | The user's locale. Defaults to UTF-8. |
| Email EncodingKey | The email encoding key. There are several selections to choose from in from the web interface. The encoding keys are customizable. Defaults to UTF-8. |
| LanguageLocaleKey | The language locale key. There are several selections to choose from in from the web interface. The locale keys are customizable. Defaults to en_US. |
| Federation Identifier | A Federation ID is an identifier that is unique within a Salesforce organization. |
| UserType | Used for defining Portal or Partner Users. Portal and Partner Users must be assigned to a Salesforce account using the Account Name provisioning policy attribute. If not configured, then the default STANDARD user will be created. Example values: PORTAL, PARTNER. |
| AccountName | A Salesforce account name to assign to a new portal or partner user. If left blank, the system creates a new Salesforce account and assigns it to the new portal or partner user. |
| PermissionSetLicense | For the Salesforce source, the PermissionSetLicense is added as an entitlement while provisioning an account. For existing sources, you must add the PermissionSetLicense object (String type) to the account schema. The Attribute Request priority is: Add PermissionSetLicense Object, Add/Remove PermissionSet, Remove PermissionSetLicense. Through the certification process, the PermissionSetLicense object cannot be removed until the associated Permission sets are removed. |
| ManagedPackage | The Salesforce source supports ManagedPackage entitlement. The source aggregates the ManagedPackage object (schema type: String; description: Managed Package assigned to a user). New Salesforce sources, by default, have ManagedPackage as an entitlement attribute while provisioning an account. For existing sources, you must manually add the ManagedPackage attribute to the schema. |
Creating Portal and Partner Users
Configure your provisioning policy to create a new portal or partner user then associate them with an existing or new Salesforce account.
To create Portal Users and Partner Users:
- Add the UserType attribute into your Create Profile provisioning policy. Supported values are
STANDARD,PARTNERandPORTAL. The default value isSTANDARD. -
Add the AccountName attribute to the provisioning policy if you want to assign it to an existing Salesforce account.
If the AccountName is not provided or not configured, a new account will be created and assigned to the new Portal or Partner User.
Note
Enabling and disabling Portal and Partner users is not supported.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.