Customize How Just-in-Time Provisioning Handlers Process Attributes in SAML Assertions
If you’re configuring just-in-time (JIT) provisioning with a custom Apex handler, and your single sign-on (SSO) identity provider sends encrypted SAML assertions, Salesforce now passes the decrypted assertion to your JIT handler. The previous process sometimes limited the JIT handler from accessing certain user attributes. The decrypted assertion is stored as a value with the key Sfdc.SamlAssertion. With access to the decrypted assertion, you can modify the way your JIT handler processes the assertion to make sure no attribute gets left behind.
Where: This change applies to Lightning Experience and Salesforce Classic in all editions.
How: Configure Salesforce as a service provider for SAML SSO and enable custom JIT with an Apex handler. Then use the SamlJitHandler interface to customize the JIT handler as needed.
Login Credentials Using URL Query Strings Are Disabled (Release Update)
With this update, users can no longer log in to Salesforce by using a username and password as URL query string parameters to the login URL. Users who try to do so are redirected to the login page. This update improves security.
Where: This change applies to Lightning Experience, Salesforce Classic, and all versions of the mobile app in all editions.
When: Salesforce enforces this update in Spring ’22. To get the major release upgrade date for your instance, go to Trust Status, search for your instance, and click the maintenance tab.
How: This update impacts you if your users or integrations log in or authenticate by passing un= and pw= as query string parameters to the login URL.
To review this update, from Setup, in the Quick Find box, enter Release Updates, and then select Release Updates. For Disable Users from Logging in to an Org with Login Credentials as Query String Parameters, enable the test run and note if users have login or authentication issues. If they’re redirected to the login page or see a redirect status code, change your login and authentication integrations by the Spring ’22 release.
Login Credentials Using URL Query Strings Are Disabled (Release Update) (salesforce.com)
Require Users to Reauthenticate When Accessing Service Providers with Single Sign-On
To protect sensitive resources, you can now configure forced authentication when Salesforce is acting as a SAML identity provider. With forced authentication, users who are already logged in to Salesforce must reenter their credentials when trying to access a third-party service provider. After setting up this feature, you can use the identity provider event log to monitor when users have been logged out due to forced authentication.
Where: This change applies to Salesforce Classic (not available in all orgs) and Lightning Experience in all editions.
How: We provide an example forced authentication SAML request. To configure forced authentication, share this request with your service provider. Your service provider then uses the SAML request to tell Salesforce that the user must reauthenticate. When Salesforce is acting as the identity provider, forced authentication is automatically supported, so no additional setup in your org is required.
Verify Logins in Users Reports
Four new verification history fields in users reports let you view user login verification data. Use these fields in combination with login history fields to identify which user logins have multi-factor authentication (MFA) challenges enforced.
Where: These changes are available in Lightning Experience in Group, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer editions.
How: Verification History fields include login method, user activity, login status, and time of login.
Verify Logins in Users Reports (salesforce.com)
MFA Challenges for Authentication Provider Single Sign-On Logins Are No Longer Enforced
By default, users who log in to Salesforce through an authentication provider that supports single sign-on (SSO) are no longer subject to multi-factor authentication (MFA) challenges in Salesforce. To restore MFA challenges for those users, you can update the session security levels for their assigned profiles.
Where: This change applies to Lightning Experience, Salesforce Classic, and the Salesforce mobile app in Personal, Group, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer editions.
How: To restore MFA challenges for a user, set Session Security Level Required at Login to High Assurance and confirm that Multi-Factor Authentication is in the High Assurance column.
Get Users Ready for Multi-Factor Authentication with Change Management Resources
As you prepare for the multi-factor authentication (MFA) requirement that goes into effect on February 1, 2022, check out the MFA Rollout Pack. It provides customizable planning and change management templates to help you roll out MFA to your users.
Where: This change applies to Lightning Experience in Essentials, Group, Professional, Enterprise, Performance, Unlimited, and Developer editions.
How: Download the MFA Rollout Pack from the Salesforce MFA Site. The pack includes:
- An MFA overview presentation to share with your leadership and stakeholders
- A sample project schedule
- A sample drip email campaign to prepare users for the coming changes to your login process
- A user training deck to use for virtual or in-person sessions
- Onboarding guides to walk users through MFA registration steps on your launch day
Get Users Ready for Multi-Factor Authentication with Change Management Resources (salesforce.com)
Streamline Identity Verification with Built-In Authenticators (Beta)
With new support for biometric methods, verifying your identity in Salesforce just got even easier. Users can register biometric built-in authenticators, such as Touch ID, Face ID, and Windows Hello. Anytime users are challenged to verify their identity, including multi-factor authentication and device activations, they’re prompted to use their built-in authenticator.
Where: This change applies to Lightning Experience and Salesforce Classic in all editions.
Why: There are a few great reasons to let your users verify their identity with built-in authenticators.
- They’re convenient. Users can breeze through identity verification without needing a second device, such as a security key or a mobile device with an authenticator app.
- They’re secure. Built-in authenticators are based on the FIDO2 Web Authentication (WebAuthn) Platform standard, making them extra resistant to security threats, like phishing.
- They ensure privacy. The user’s biometric data never leaves their device.
Before you enable built-in authenticators, it’s important to keep these things in mind.
- The user’s device, browser, and operating system must support the FIDO2 WebAuthn Platform standard.
- To use a built-in authenticator, the user must have access to the device where it’s enrolled. Users who access Salesforce from multiple devices must register a built-in authenticator on each device. We also recommend that users register another verification method, such as Salesforce Authenticator.
Streamline Identity Verification with Built-In Authenticators (Beta) (salesforce.com)
Trailblazer.me Supports New Languages
To improve accessibility for our global Trailblazer community, Trailblazer.me now supports 11 more languages: Danish, Dutch, Finnish, Italian, Korean, Norwegian, Russian, Simplified Chinese, Spanish (Spain), Swedish, and Traditional Chinese.
Where: This change applies to all editions.
When: This change takes effect on November 17, 2021.
Trailblazer.me Supports New Languages (salesforce.com)
Salesforce Identity for Your Employees
Users can now register biometric built-in authenticators, such as Touch ID, Face ID, and Windows Hello. You can monitor which users register built-in authenticators and when they use them. As you prepare for the multi-factor authentication (MFA) requirement, check out the MFA Rollout Pack for customizable templates. Also, users are no longer subject to MFA challenges in Salesforce when they log in through an authentication provider that supports single sign-on. And you can track enforced MFA challenges with four new verification history fields in users reports. For increased security, configure forced authentication when Salesforce is acting as a SAML identity provider. Salesforce now prevents users from logging in with a username and password as GET query string parameters to the login URL. Upgrade to Identity Connect 7.1 as soon as possible because Salesforce no longer supports downloads for Identity Connect 2.1 and Identity Connect 3.0.X.X. For improved functionality, customize the way your JIT handler processes user information, include refresh tokens in the OAuth 2.0 user-agent flow, and authorize additional access to Salesforce CDP data.
- Trailblazer.me Supports New Languages
To improve accessibility for our global Trailblazer community, Trailblazer.me now supports 11 more languages: Danish, Dutch, Finnish, Italian, Korean, Norwegian, Russian, Simplified Chinese, Spanish (Spain), Swedish, and Traditional Chinese. - Streamline Identity Verification with Built-In Authenticators (Beta)
With new support for biometric methods, verifying your identity in Salesforce just got even easier. Users can register biometric built-in authenticators, such as Touch ID, Face ID, and Windows Hello. Anytime users are challenged to verify their identity, including multi-factor authentication and device activations, they’re prompted to use their built-in authenticator. - Get Users Ready for Multi-Factor Authentication with Change Management Resources
As you prepare for the multi-factor authentication (MFA) requirement that goes into effect on February 1, 2022, check out the MFA Rollout Pack. It provides customizable planning and change management templates to help you roll out MFA to your users. - MFA Challenges for Authentication Provider Single Sign-On Logins Are No Longer Enforced
By default, users who log in to Salesforce through an authentication provider that supports single sign-on (SSO) are no longer subject to multi-factor authentication (MFA) challenges in Salesforce. To restore MFA challenges for those users, you can update the session security levels for their assigned profiles. - Verify Logins in Users Reports
Four new verification history fields in users reports let you view user login verification data. Use these fields in combination with login history fields to identify which user logins have multi-factor authentication (MFA) challenges enforced. - Require Users to Reauthenticate When Accessing Service Providers with Single Sign-On
To protect sensitive resources, you can now configure forced authentication when Salesforce is acting as a SAML identity provider. With forced authentication, users who are already logged in to Salesforce must reenter their credentials when trying to access a third-party service provider. After setting up this feature, you can use the identity provider event log to monitor when users have been logged out due to forced authentication. - Login Credentials Using URL Query Strings Are Disabled (Release Update)
With this update, users can no longer log in to Salesforce by using a username and password as URL query string parameters to the login URL. Users who try to do so are redirected to the login page. This update improves security. - Customize How Just-in-Time Provisioning Handlers Process Attributes in SAML Assertions
If you’re configuring just-in-time (JIT) provisioning with a custom Apex handler, and your single sign-on (SSO) identity provider sends encrypted SAML assertions, Salesforce now passes the decrypted assertion to your JIT handler. The previous process sometimes limited the JIT handler from accessing certain user attributes. The decrypted assertion is stored as a value with the keySfdc.SamlAssertion. With access to the decrypted assertion, you can modify the way your JIT handler processes the assertion to make sure no attribute gets left behind. - Upgrade to Identity Connect 7.1.1
Identity Connect 7.1.1 offers extensive security enhancements. As of the Winter ’22 release, you can no longer download Identity Connect 2.1 and Identity Connect 3.0.X.X. We recommend that you upgrade to Identity Connect 7.1.1 as soon as possible. - Give Authorized Access to Salesforce CDP Data
To authorize additional access to Salesforce CDP data, you can assign a connected app two new OAuth scopes. With the Perform ANSI SQL queries on Salesforce CDP data OAuth scope, the connected app can perform ANSI SQL queries of Salesforce CDP data on behalf of the user. The Manage Salesforce CDP profile data OAuth scope gives the connected app access to Salesforce CDP REST API data to manage profile records. - OAuth 2.0 User-Agent Flow Supports mobileauth.salesforce.com/analytics Redirect URL for Refresh Tokens
The OAuth 2.0 user-agent flow now supports refresh tokens when thescope=refresh_tokenis included in the request and the redirect URL ishttps://mobileauth.salesforce.com/analytics/oauth/done.
Salesforce Identity for Your Employees
Identity and Access Management
Salesforce Identity and Access Management now supports built-in authenticators, tracking of enforced multi-factor authentication (MFA) challenges, and Identity Connect 7.1. Prepare for the upcoming MFA requirement with the MFA Rollout Pack. For Salesforce Customer Identity, benefit from a new email template that provides consistent branding and control over customer communications.
- Salesforce Identity for Your Employees
Users can now register biometric built-in authenticators, such as Touch ID, Face ID, and Windows Hello. You can monitor which users register built-in authenticators and when they use them. As you prepare for the multi-factor authentication (MFA) requirement, check out the MFA Rollout Pack for customizable templates. Also, users are no longer subject to MFA challenges in Salesforce when they log in through an authentication provider that supports single sign-on. And you can track enforced MFA challenges with four new verification history fields in users reports. For increased security, configure forced authentication when Salesforce is acting as a SAML identity provider. Salesforce now prevents users from logging in with a username and password as GET query string parameters to the login URL. Upgrade to Identity Connect 7.1 as soon as possible because Salesforce no longer supports downloads for Identity Connect 2.1 and Identity Connect 3.0.X.X. For improved functionality, customize the way your JIT handler processes user information, include refresh tokens in the OAuth 2.0 user-agent flow, and authorize additional access to Salesforce CDP data. - Salesforce Identity for Your Customers
Maintain consistent branding for your site and control customer communications with the Device Activation email template. When you’re using Apex to manage identity verification for Experience Cloud sites, guarantee that self-registration verification messages are sent in the right language. To improve privacy and security, we shortened durations of the lloopch_loid and hideIdentityDialog cookies and increased the length of one-time passwords.
Identity and Access Management (salesforce.com)