Page Comparison

The EmpowerID Salesforce SCIM connector uses the SCIM 2.0 protocol to allow you to bring the user data from your Salesforce tenant to EmpowerID, where it can be used to provision EmpowerID Persons, and be synchronized with data in any connected back-end user directories.

A key component of the Salesforce SCIM connector is the EmpowerID Salesforce SCIM microservice that you deploy to an Azure app service, which in turn retrieves information from Salesforce. From a high level, the below image depicts the deployment model for the connector.

...

...

Next Steps

connector is a bi-directional connector that communicates with the Salesforce SCIM microservice for inventory and write-back functionality of users, groups, group membership, and user licenses between EmpowerID and Salesforce via REST API calls to Salesforce. The Salesforce SCIM microservice is an EmpowerID microservice that you deploy to an Azure app service. The app service uses a system-assigned managed identity linked to an application you create in Azure AD for EmpowerID. The managed identity allows the microservice to access Azure AD-protected services without needing to supply credentials for authentication. The entire process uses secure client certificate authentication. The connector authenticates to the microservice using Azure Authentication. The request and response of the microservice are SCIM compliant.

...

Inventory Objects and their corresponding components in EmpowerID

The Salesforce connector supports both full and incremental inventory. The connector uses Salesforce Object Query Language (SOQL) to retrieve data from Salesforce. When inventory is first enabled, the connector performs a full inventory to sync all the accounts, groups, group membership and user licenses. On subsequent runs, the inventory job looks for modified objects only.

Users in Salesforce are inventoried as accounts in EmpowerID and added as records to the Account table of the EmpowerID Identity and Resource Warehouse. The connector supports both full and incremental inventory for accounts. Each time full inventory runs, the connector syncs all the accounts from the external system to EmpowerID. Full Inventory uses a query to get all the accounts from Salesforce. The query contains a comma separated list of user attributes to be inventoried and is configurable by editing the UserQueryMessage parameter on the Salesforce SCIM resource system. The below code depicts what the default query looks like.

Select ID,LastModifiedDate,Username,LastName,FirstName,Name,CompanyName,Department,Title,Street,City,State,PostalCode,Country,
Address,Email,Phone,Alias,CommunityNickname,IsActive,TimeZoneSidKey,LocaleSidKey,EmailEncodingKey,ProfileId,UserRoleId,LanguageLocaleKey,
ManagerId,LastLoginDate,LastPasswordChangeDate,CreatedDate,UserPermissionsMarketingUser,UserPermissionsOfflineUser,UserPermissionsCallCenterAutoLogin,
DefaultGroupNotificationFrequency,UserPermissionsKnowledgeUser,UserPermissionsLiveAgentUser,UserPermissionsSupportUser from User

Incremental inventory uses the LastModifiedDate attribute to bring only the accounts modified after the last inventory run. Any updates made to the user on the external system will be synced to EmpowerID account.

Inventoried Account Attributes

The below table contains a list of account attributes inventoried by the out-of-the-box connector.

Groups in Salesforce are inventoried as groups and added as records to the Group table of the EmpowerID Identity and Resource Warehouse. Group members are added as records to the GroupAccount table. The connector supports both full and incremental inventory for groups, whereas inventory for group memberships is always a complete inventory. Each time full inventory runs, the connector syncs all groups and group memberships from the external system to EmpowerID.

Full inventory uses separate queries to retrieve groups and group memberships from Salesforce. Each query contains a comma separated list of attributes to be inventoried that can be customized by editing the associated query parameter on the Salesforce SCIM resource system.

Query parameters include the following:

Select ID, UserLicenseId, Name from Profile

Select ID,LastModifiedDate,Name from UserRole

Select ID,Name from PermissionSet

Select ID,Name from Group where type = 'regular'

Incremental inventory uses the LastModifiedDate attribute to bring only the groups modified after the last inventory run. Any updates made on the external system will be synced to EmpowerID Group. If a group is disabled on the external system and the CheckForDeletedObjectsEnabled setting for the Salesforce SCIM account store is turned on, EmpowerID marks the group as deleted and sets the deleted date on the group.

Inventoried Group Attributes

The below table contains a list of group attributes inventoried by the out-of-the-box connector.

User licenses in Salesforce are inventoried and added as records to the GroupLicense table of the EmpowerID Identity and Resource Warehouse. The connector supports both full and incremental inventory for user licenses. Each time full inventory runs, the connector syncs all user licenses from the external system to EmpowerID. Full Inventory uses a query to get all the user licenses from Salesforce. The query contains a comma separated list of user license attributes to be inventoried that can be configured by editing the UserLicenseQueryMessage parameter on the Salesforce SCIM resource system. The below code depicts what the default query looks like.

Select ID,LastModifiedDate,Name,TotalLicenses,UsedLicenses from UserLicense

Incremental inventory uses the LastModifiedDate attribute to bring only the user licenses modified after the last inventory run. Any updates made to the user on the external system will be synced to the EmpowerID Group License.

Deploy the Salesforce SCIM Microservice

Connect to Salesforce (SCIM Connector)