Patron Manager – Admin Guide
Login URLs
Production SSO URL: https://caclive.my.salesforce.com
Production Bypass SSO Login: https://caclive.my.salesforce.com/?login
Sandbox SSO URL: https://caclive--ssotest.my.salesforce.com
Sandbox Bypass SSO Login: https://caclive--ssotest.my.salesforce.com/?login
User Administration handled by
CAC Senior Accountant/Cac Financial Specialist - Kristen Walker
Add users to the system
- Search Active Directory for groups “Access-App_PatronManager”
- Select appropraite group
- The PatronManager/Salesforce Profile is assigned by these groups.
- Add users to an appropriate group.
- Users should only be in one group. If they are in multiple groups, then the least privileged group will apply.
- When the user accesses the system by the SSO URL above, Salesforce will automatically create a user with the following attributes.
|
First Name
|
Last Name
|
Alias
|
|
Email
|
UserName
|
Community Nickname
|
|
Title
|
Department
|
Profile
|
|
Email Encoding
|
Street
|
Federation ID
|
- Note: If a user has problems signing in, make sure the country code on the user is set to United States.
- Once a user signs-in, Add lightning experience
- Setup > Administration > Users > Users
- Click “Permission Set Assignments” link at top
- Edit Assignments
- Locate “PMGR Lightning Experience” and click Add
- Click Save
Remove users from system
- Search Active Directory for groups “Access-App_PatronManager”
- Select appropraite group
- The PatronManager/Salesforce Profile is assigned by these groups.
- Remove users from group.
- Log in to PatronManager as a System Administrator
- Perform PatronManager procedure for removing user – (migrating reports to other users)
- Click on the gear in the upper right and select Setup
- In the left column, type “Users” in the Quick Find box.
- Select “Users”
- Click “Edit” next to the user to be disabled
- Uncheck the “Active box in the right column
- Click “Save” at the top
Add new profile in PatronManager
If a new Profile is created in PatronManger/Salesforce, Open a ticket with ITS
Provide the exact name of the new profile and short description of profile
ITS Tasks
Create a new Active Directory group following the naming convention
- Access-App_PatronManager_#PROFILE#
- Group Description will be the description provided that identifies what the profile does
In the Azure Enterprise Application “PCT-PatronManager”
- Select “Users and Groups”
- Add the new group “Access-App_PatronManager_#PROFILE#”
- Select “Single sign-on”
- In the Attributes & Claims box, Click Edit
- Click on “User.ProfileID” to edit
- Under Claim Conditions, Add a new line
- User type: Members
- Scoped Groups: Access-App_PatronManager_#PROFILE#
- Source: Attribute
- Value: Type the exact name of the new profile (not the group name)
- Click on the 3 dots on the right to order the list from Most access to least access
- When users log in they are matched to these conditions from top to bottom.
SSO Certificate renewal
The SSO Certificate will expire on 12/01/2028
- ITS will create a new certificate in the Azure Enterprise Application and download the .CER file
- In PatronManager/Salesforce setup, Locate the “Single sign-on Settings”
- Edit the “Azure-PCT-PatronManger” item
- Select the “Choose File” button next to “Identity Provider Certificate”
- Select the .CER File provided by ITS
- Select Open
- Click on Save
- Verify the “Request Signing Certificate” and “Assertion Decryption Certificate” are set to new certificate
Troubleshooting
User not in the Active Directory group: Error--User is not assigned to a role
Multi-Factor Authentication
Salesforce has required all users with "System Administrator" role to use a Phishing Resistant MFA method. PCT has accomplished this by using Yubi Keys (FIDO2). The SAML response included attributes that let Salesforce know that Phishing Resistant MFA has been performed.