Patron Manager - End User Guide

Patron Manager – Admin Guide

Login URLs

Production SSO URL: https://caclive.my.salesforce.com

Production Bypass SSO Login: https://caclive.my.salesforce.com/?login

Sandbox SSO URL: https://caclive--ssotest.my.salesforce.com

Sandbox Bypass SSO Login: https://caclive--ssotest.my.salesforce.com/?login

User Administration handled by 

CAC Senior Accountant/Cac Financial Specialist - Kristen Walker 

Add users to the system

• Search Active Directory for groups “Access-App_PatronManager”
• The PatronManager/Salesforce Profile is assigned by these groups.
• Add users to an appropriate group.
• Users should only be in one group. If they are in multiple groups, then the least privileged group will apply.
• When the user accesses the system by the SSO URL above, Salesforce will automatically create a user with the following attributes.

Remove users from system

• Search Active Directory for groups “Access-App_PatronManager”
• The PatronManager/Salesforce Profile is assigned by these groups.
• Remove users from group.
• Log in to PatronManager as a System Administrator
• Perform PatronManager procedure for removing user – (migrating reports to other users)
• Click on the gear in the upper right and select Setup

In the left column, type “Users” in the Quick Find box.

Select “Users”

Click “Edit” next to the user to be disabled

Uncheck the “Active box in the right column

Click “Save” at the top

Add new profile in PatronManager

                If a new Profile is created in PatronManger/Salesforce, Open a ticket with ITS

                Provide the exact name of the new profile and short description of profile

ITS Tasks

Create a new Active Directory group following the naming convention

•  Access-App_PatronManager_#PROFILE#
• Group Description will be the description provided that identifies what the profile does               

In the Azure Enterprise Application “PCT-PatronManager”

• Select “Users and Groups”
  • Add the new group “Access-App_PatronManager_#PROFILE#”
• Select “Single sign-on”
  • In the Attributes & Claims box, Click Edit
  • Click on “User.ProfileID” to edit
  • Under Claim Conditions, Add a new line
  • User type: Members
  • Scoped Groups: Access-App_PatronManager_#PROFILE#
  • Source: Attribute
  • Value: Type the exact name of the new profile (not the group name)
  •  Click on the 3 dots on the right to order the list from Most access to least access
    •  When users log in they are matched to these conditions from top to bottom. 

SSO Certificate renewal

The SSO Certificate will expire on 1/19/2025

• ITS will create a new certificate in the Azure Enterprise Application and download the .CER file
•                 In PatronManager/Salesforce setup, Locate the “Single sign-on Settings”
•                 Edit the “Azure-PCT-PatronManger” item
•                 Select the “Choose File” button next to “Identity Provider Certificate”
•                 Select the .CER File provided by ITS
•                 Select Open
•                 Click on Save
•                 Verify the “Request Signing Certificate” and “Assertion Decryption Certificate” are set to new certificate

Troubleshooting

                User not in the Active Directory group: Error--User is not assigned to a role

Bypass SSO

If SSO is suffering an extended outage, certificate has expired, or external user needs access, they can use the bypass SSO URL at the top of this document.

Multi-Factor Authentication

User that are not part of Pennsylvania College of Technology

Salesforce MFA will need setup for any external user.

Set MFA user permission via permission set - https://help.salesforce.com/s/articleView?id=sf.mfa_enable_core.htm&type=5