CloudAccess creates a new account or merges an existing account in the SaaS applications for users that are members of mapped groups in the identity sources. This is called provisioning.
Provisioning occurs in two ways:
Automatic provisioning occurs when you map authorizations for the SaaS applications to the identity source roles.
You can configure the SaaS connectors to allow users control of when their accounts are provisioned. A configuration option is available on the Connector for Google Apps and the Connector for Salesforce to Prompt users for an existing account before provisioning.
When you select this option, users have two choices: create a new account or specify an existing SaaS application account during their initial attempt to access the SaaS application using single sign-on through CloudAccess.
When provisioning a new account, CloudAccess determines if a matching user account already exists in the SaaS application. If a match is found, CloudAccess merges the user with the existing SaaS application account. If no match is found, CloudAccess creates a new account. For more information, see the following sections:
The following sections define the matching criteria of the connectors that provision users:
Table 1-1 contains the matching criteria for the Connector for Google Apps. CloudAccess compares the Google Apps email attribute value to the listed identity source attribute value. If there is a match, CloudAccess merges the accounts. If there is no match, CloudAccess creates a new account in Google Apps.
Table 1-1 Google Apps Matching Criteria
|
Google Apps Attribute |
Identity Source: Active Directory Attribute |
Identity Source: eDirectory Attribute |
|
|---|---|---|---|
|
Attribute Name |
UserName |
sAMAccountName |
CN |
|
Display Name |
|
User logon name |
Common Name |
Table 1-2 contains the matching criteria for the Connector for Office 365. CloudAccess compares the Office 365 userPrincipalName attribute value with the value in the identity source attribute plus the @ sign plus the Office 365 federated domain name. If the values match, CloudAccess merges the accounts. If there is no match, CloudAccess creates a new account in Office 365.
Table 1-2 Office 365 Matching Criteria
|
Office 365 Attribute |
Identity Source: Active Directory Attribute |
Identity Source: eDirectory Attribute |
|
|---|---|---|---|
|
Attribute Name |
userPrincipalName (upn) |
sAMAccountName@Federated Domain Name |
CN@Federated Domain Name |
|
Display Name |
User name |
User logon name@Federated Domain Name |
Common Name@Federated Domain Name |
Table 1-3 contains the matching criteria for the Connector for Salesforce. CloudAccess matches on three different attributes in a priority order. If CloudAccess does not find a match for the value in the first attribute, it performs a search in the value of the second attribute, and if it does not find a match, it performs the search for the value in the third attribute.
Table 1-3 Salesforce Matching Criteria
|
Salesforce Attribute |
Identity Source: Active Directory Attribute |
Identity Source: eDirectory Attribute |
|---|---|---|---|
|
First Priority |
|
|
|
|
Attribute Name |
Federation Identifier |
objectGUID |
GUID |
|
Second Priority |
|
|
|
|
Attribute Name |
Username |
sAMAccountName@Salesforce Domain Name |
CN@Salesforce Domain Name |
|
Display Name |
Username |
User logon name@Salesforce Domain Name |
Common Name@Salesforce Domain Name |
|
Third Priority |
|
|
|
|
Attribute Name |
Username |
|
Internet EMail Address |
|
Display Name |
Username |
|
E-Mail Address |
CloudAccess contains a defined naming convention for creating the user accounts in the SaaS applications.
Table 1-4 CloudAccess Naming Convention
|
Identity Source |
Connector for Google Apps |
Connector for Salesforce |
|---|---|---|
|
Active Directory |
sAMAccountName |
sAMAccountName@Salesforce Domain Name |
|
eDirectory |
CN |
CN@Salesforce Domain Name |
As shown in Table 1-4, the user name attribute in Salesforce is in the form of an email address. CloudAccess creates a unique user name based on the sAMAccountName or CN of the user object in the identity source prepended to the domain name configured in the Company Profile at the Salesforce account.
Sample experience with the Prompt users for an existing account before provisioning option enabled:
The administrator selects the Prompt users for an existing account before provisioning option when configuring the connector for the SaaS application.
The administrator maps one or more SaaS authorizations to the identity source role and grants approval, if required.
Users log in to CloudAccess with their identity source credentials.
CloudAccess presents users with icons of the SaaS applications they are entitled to access.
Users click the icon for the entitled SaaS application.
CloudAccess presents two options to users:
I do not have an existing account. Create one for me.
I already have an existing account. These are my credentials:
Users select I do not have an existing account. Create one for me.
or
Users select I already have an existing account. These are my credentials, then specify their credentials for the existing SaaS account.
Regardless of the option the user selects, CloudAccess searches for an existing, matching account.
(Conditional) If CloudAccess finds an existing account (for example, the user’s mail attribute in the identity source matches a user name in the Salesforce domain), CloudAccess merges the existing account with the new account it creates for the user.
(Conditional) If CloudAccess does not find an existing account, CloudAccess creates a new account for the user in the SaaS application following the naming conventions in Table 1-4.
Whether CloudAccess merges the user account or creates a new account, the user’s SaaS application password is set to a random value that CloudAccess generates. The user’s authentication to the SaaS application now uses SAML single sign-on. For information about using SAML single sign-on, see Section 5.0, Providing Access to the SaaS Applications for Users.
Sample experience with the automatic account creation:
The administrator maps one or more SaaS authorizations to the identity source role and grants approval, if required.
(Conditional) The person with the Approval role approves or denies the account creation.
CloudAccess searches for an existing, matching account.
(Conditional) If CloudAccess finds an existing account (for example, the user’s mail attribute in the identity source matches a user name in the Salesforce domain), CloudAccess merges the existing account with the new account it creates for the user.
(Conditional) If CloudAccess does not find an existing account, CloudAccess creates a new account for the user in the SaaS application following the naming conventions in Table 1-4.
Users log in to CloudAccess with their identity source credentials.
CloudAccess presents users with icons of the SaaS applications they are entitled to access.
Users click the icon for the entitled SaaS application, then CloudAccess uses the SAML single sign-on to authenticate the users to the SaaS application.