Data provisioning

Connector settings

Parameter	Value
Base address	`{baseURL}`
Authentication mode	OAuth2
OAuth Grant Type	Client credentials
URL for Authorization token	`{baseURL}/services/oauth2/token`
OAuth Client ID	`{Client ID}`
OAuth Client Secret	`{Client Secret}`
Skip URL encoding	Select the checkbox
Test connection	Select the checkbox
Test query	`/services/data/v61.0/query?q=SELECT FIELDS(All) FROM USER ORDER BY Name LIMIT 10`

Task mappings

The Salesforce connectivity provides the following mappings:

Parameter	Description
SalesforceUser	Contains mappings for users. If the profile selected is Customer and Partner, creates the contact.
SalesforceProfile	Contains mappings for assigning users to profiles.
SalesforceUserRoleAssignment	Contains mappings for assigning users to roles.
SalesforceGroupAssignment	Contains mappings for assigning users to groups.
SalesforcePermissionSetAssignment	Contains mappings for assigning users to permissions sets.
SalesforceAccount	Contains mappings for creating an account if your profile is Customer and Partner.

Salesforce User

The object is used to create, update, and deactivate user (account).

Parameter	Type	Description
Object Id	Map	ObjectId
Object type	Expression	ROPE_ATTR_C_SALESFORCEACCOUNT == "Account" && Operation == "Create" ? "services/data/v61.0/sobjects/User" : ROPE_ATTR_C_SALESFORCEACCOUNT != "Account" && Operation == "Create" ? "services/data/v61.0/sobjects/Contact" : null
Operation	Expression	Operation == "Create" && ROPE_ATTR_C_SALESFORCEACCOUNT != "Account" ? "CreateIfNotExists" : Operation
FirstName	Map	ROPE_ATTR_FIRSTNAME
LastName	Map	ROPE_ATTR_LASTNAME
CommunityNickname	Expression	(ROPE_ATTR_C_SALESFORCEACCOUNT == "Account" && Operation == "Create") \|\| Operation == "Update" ? ROPE_ATTR_IDENTITYID : null
Email	Map	ROPE_ATTR_EMAIL
Department	Expression	(ROPE_ATTR_C_SALESFORCEACCOUNT == "Account" && Operation == "Create") \|\| Operation == "Update" ? ROPE_ATTR_JOBTITLE : null
Alias	Expression	(ROPE_ATTR_C_SALESFORCEACCOUNT == "Account" && Operation == "Create") \|\| Operation == "Update" ? ROPE_ATTR_IDENTITYID.Substring(0, Math.Min(8,ROPE_ATTR_IDENTITYID.Length)) : null
IsActive	Expression	ROPE_ATTR_C_SALESFORCEACCOUNT != "Account" && Operation == "Create" ? null : ROPE_ATTR_C_SALESFORCEACCOUNT == "Account" && Operation == "Create" && ROPE_Disabled == false ? "true" : (ROPE_Disabled==true \|\| Operation == "DeleteIfExists" ? "false" : "true")
ProfileId	Expression	ROPE_ATTR_C_SALESFORCEACCOUNT == "Account" && Operation == "Create" ? ROPE_ATTR_C_SALESFORCEUSERPROFILE : null
TimeZoneSidKey	Expression	ROPE_ATTR_C_SALESFORCEACCOUNT == "Account" && Operation == "Create" ? "Europe/Paris" : null
EmailEncodingKey	Expression	ROPE_ATTR_C_SALESFORCEACCOUNT == "Account" && Operation == "Create" ? "UTF-8" : null
LocaleSidKey	Expression	ROPE_ATTR_C_SALESFORCEACCOUNT == "Account" && Operation == "Create" ? "da_DK" : null
LanguageLocaleKey	Expression	ROPE_ATTR_C_SALESFORCEACCOUNT == "Account" && Operation == "Create" ? "da" : null
Username	Expression	(ROPE_ATTR_C_SALESFORCEACCOUNT == "Account" && Operation == "Create")
AccountId	Expression	ROPE_ATTR_C_SALESFORCEACCOUNT != "Account" && Operation == "Create" ? ROPE_ATTR_IDENTITYID : null
userId	Expression	Operation == "Update" ? ROPE_DistinguisedName : null
userEmail	Expression	Operation == "Create" && ROPE_ATTR_C_SALESFORCEACCOUNT != "Account" ? ROPE_ATTR_EMAIL : null

The fields EmailEncodingKey, TimeZoneSidKey, LanguageLocaleKey, and Username should be modified based on the data being sent, as different language and time zone settings may apply. If necessary, adjust these fields to ensure the data is sent correctly (according to the regional and language preferences).

Salesforce Profile Assignment

The object is used to create and update profile and user assignments.

Parameter	Type	Description
Object Id	Map	ObjectId
Object type	Constant	SalesforceProfile
Operation	Constant	createOrUpdate
FirstName	Map	ROPE_ATTR_FIRSTNAME
LastName	Map	ROPE_ATTR_LASTNAME
CommunityNickname	Map	ROPE_ATTR_IDENTITYID
Email	Map	ROPE_ATTR_EMAIL
Department	Map	ROPE_ATTR_JOBTITLE
ProfileId	Expression	Operation != "Delete" ? ROPE_ATTR_ODWLOGICKEY : null
Alias	Expression	ROPE_ATTR_IDENTITYID.Substring(0, Math.Min(8,ROPE_ATTR_IDENTITYID.Length))
TimeZoneSidKey	Expression	Operation == "Create" ? "Europe/Paris" : null
EmailEncodingKey	Expression	Operation == "Create" ? "UTF-8" : null
LocaleSidKey	Expression	Operation == "Create" ? "da_DK" : null
IsActive	Expression	ROPE_Disabled==true \|\| Operation == "DeleteIfExists" ? "false" : "true"
LanguageLocaleKey	Expression	Operation == "Create" ? "da" : null
Username	Expression	Operation == "Create" ? ROPE_ATTR_IDENTITYID + "@salesforce.net" : null
AccountId	Expression	Extensions.GetFirstValue(ROPE_DistinguisedName, ROPE_ExternalAnchor, ROPE_AccountExternalAnchor, JobAnchor)
ContactId	Map	ROPE_ATTR_EMAIL

Salesforce User Role Assignment

The object is used to create and delete role and user assignments.

Parameter	Type	Description
Object Id	Map	ObjectId
Object type	Constant	SalesforceUserRoleAssignemnet
Operation	Map	Operation
AccountId	Map	ROPE_ATTR_EMAIL
UserRoleId	Expression	`Operation != "Delete" ? ROPE_ATTR_ODWLOGICKEY : ""`

Salesforce Group Assignments

The object is used to create and delete users to a group.

Parameter	Type	Description
Object Id	Map	ObjectId
Object type	Constant	SalesforceGroupAssignment
Operation	Map	Operation
GroupId	Expression	`Operation == "Create" ? ROPE_ATTR_ODWLOGICKEY : null`
UserOrGroupId	Expression	`Operation == "Create" ? ROPE_ATTR_EMAIL : null`
AssignmentId	Expression	`Operation != "Create" ? ROPE_ATTR_C_SALESFORCE_GROUP_ASSIGNMENTID : null`

Salesforce Permission Set Assignments

The object is used to create and delete permission set and user assignments.

Parameter	Type	Description
Object Id	Map	ObjectId
Object type	Constant	SalesforcePermissionSetAssignment
Operation	Map	Operation
AssigneeId	Expression	Operation == "Create" ? ROPE_ATTR_EMAIL : null
PermissionSetId	Expression	Operation == "Create" ? ROPE_ATTR_ODWLOGICKEY : null
AssignmentId	Expression	Operation != "Create" ? ROPE_ATTR_C_SALESFORCEASSIGNMENTID : null

Salesforce Account

The object is used to create accounts in Salesforce (only some profiles require the account creation).

Parameter	Type	Description
Object Id	Map	ObjectId
Object type	Constant	SalesforceAccount
Operation	Map	Operation
Name	Expression	DOLM_IDENTITYREF_Key
userAccount	Expression	DOLM_IDENTITYREF_Key

RoPE configuration

Open the RoPE configuration file:
- On-prem: \Omada Identity Suite\Role and Policy Engine\Service\ConfigFiles
- Cloud: In the Cloud Management Portal, navigate to Environments. In the environment row, from the drop-down menu, select Configure. Choose the RoPE configuration tab.
Add the following lines under the Attribute Value Resolver extension (change the key value in case you already have that specific key defined):

<add key="setting8" name="Salesforce Account:C_SALESFORCEUSERPROFILE" extraInfo="Type:ReferencePath" value="/#ASSIGNMENTS_PER_RESOURCETYPE/Salesforce Profile:[ODWLOGICKEY]" />

Add the following lines under the Map Attributes From Actual Data Extension (change the key value in case you already have that specific key defined):

<add key="3" extraInfo="Salesforce Permission Set" name="AssignmentID" value="C_SALESFORCEASSIGNMENTID" />
<add key="4" extraInfo="Salesforce Group" name="GroupAssignmentId" value="C_SALESFORCE_GROUP_ASSIGNMENTID" />

Event definition

Salesforce requires the creation of an account and contact depending on the type of profile you wish to create. For example, to create a user with the Customer Community User profile, you need to create both an account and a contact before creating a user in Salesforce. To ensure this process works correctly, create an event definition to trigger the necessary actions based on the resource requesting access.

Go to Setup > Administration > Process configuration > Event definitions. Click New.
Enter the following details:
- Name: Salesforce - Create Account
- Event is triggered when: Check box A new object is created
- Triggers on objects of type: Resource Assignments
Click Apply.
Create a new code method. Click New.
Select Execute code method. Enter the following details and click OK:
- targetSystemUid: To find your targetSystemUid, navigate to your Salesforce system then press Ctrl + right-click and select Form data UID. Copy the UID and paste it into the targetSystemUid field.
- operationEnum: CreateIfNotExists
- priority: 1
Click Filter, then New. Enter the following details:
- Left side: Resource [ROLEREF]
- Inne operator: in
- Right side (reference):
  - B2B Reordering Portal Buyer Profile
  - Customer Community Login User
  - Customer Community Plus Login User
  - Customer Community Plus User
  - Customer Community User
  - Customer Portal Manager Custom
  - Customer Portal Manager Standard
  - External Apps Login User
  - Gold Partner User
  - High Volume Customer Portal User
  - Partner Community Login User
  - Partner Community User
  - Silver Partner User
Click OK.

Additional configuration - creating users (accounts)

There are certain profiles in Salesforce that require the creation of an account and a contact before creating a user. The following section explains how this process works in Omada. When you make an access request to create an account, select the profile that the user will use in Salesforce. When creating an account, Omada first queries what type of the account you want to create: User or Partner Customer.

If you select Partner Customer, the following process takes place:

Omada triggers an event to create an account in Salesforce. It is followed by the creation of the contact and then user account. The order is important, as each step depends on the previous one.
Access request:
Omada Provisioning Services:
Omada creates an account:
Omada creates a contact and a user:

Connector settings​

Task mappings​

Salesforce User​

Salesforce Profile Assignment​

Salesforce User Role Assignment​

Salesforce Group Assignments​

Salesforce Permission Set Assignments​

Salesforce Account​

RoPE configuration​

Event definition​

Additional configuration - creating users (accounts)​