Patron Manager - End User Guide

Patron Manager – Admin Guide

Login URLs

Production SSO URL: https://caclive.my.salesforce.com

Production Bypass SSO Login: https://caclive.my.salesforce.com/?login

Sandbox SSO URL: https://caclive--ssotest.my.salesforce.com

Sandbox Bypass SSO Login: https://caclive--ssotest.my.salesforce.com/?login

User Administration handled by 

CAC Senior Accountant/Cac Financial Specialist - Kristen Walker 

Add users to the system

• Search Active Directory for groups “Access-App_PatronManager”
  • Select appropraite group
  • The PatronManager/Salesforce Profile is assigned by these groups.
• Add users to an appropriate group.
• Users should only be in one group. If they are in multiple groups, then the least privileged group will apply.
• When the user accesses the system by the SSO URL above, Salesforce will automatically create a user with the following attributes.

• Note: If a user has problems signing in, make sure the country code on the user is set to United States.
• Once a user signs-in, Add lightning experience
  • Setup > Administration > Users > Users
  • Click “Permission Set Assignments” link at top
  • Edit Assignments
  • Locate “PMGR Lightning Experience” and click Add
  • Click Save

Remove users from system

• Search Active Directory for groups “Access-App_PatronManager”
  • Select appropraite group
  • The PatronManager/Salesforce Profile is assigned by these groups.
• Remove users from group.
• Log in to PatronManager as a System Administrator
• Perform PatronManager procedure for removing user – (migrating reports to other users)
• Click on the gear in the upper right and select Setup

• In the left column, type “Users” in the Quick Find box.
• Select “Users”

• Click “Edit” next to the user to be disabled
• Uncheck the “Active box in the right column
• Click “Save” at the top

Add new profile in PatronManager

                If a new Profile is created in PatronManger/Salesforce, Open a ticket with ITS

                Provide the exact name of the new profile and short description of profile

ITS Tasks

Create a new Active Directory group following the naming convention

•  Access-App_PatronManager_#PROFILE#
• Group Description will be the description provided that identifies what the profile does               

In the Azure Enterprise Application “PCT-PatronManager”

• Select “Users and Groups”
  • Add the new group “Access-App_PatronManager_#PROFILE#”
• Select “Single sign-on”
  • In the Attributes & Claims box, Click Edit
  • Click on “User.ProfileID” to edit
  • Under Claim Conditions, Add a new line
  • User type: Members
  • Scoped Groups: Access-App_PatronManager_#PROFILE#
  • Source: Attribute
  • Value: Type the exact name of the new profile (not the group name)
  •  Click on the 3 dots on the right to order the list from Most access to least access
    •  When users log in they are matched to these conditions from top to bottom. 

SSO Certificate renewal

The SSO Certificate will expire on 12/01/2028

• ITS will create a new certificate in the Azure Enterprise Application and download the .CER file
•                 In PatronManager/Salesforce setup, Locate the “Single sign-on Settings”
•                 Edit the “Azure-PCT-PatronManger” item
•                 Select the “Choose File” button next to “Identity Provider Certificate”
•                 Select the .CER File provided by ITS
•                 Select Open
•                 Click on Save
•                 Verify the “Request Signing Certificate” and “Assertion Decryption Certificate” are set to new certificate

Troubleshooting

                User not in the Active Directory group: Error--User is not assigned to a role

Multi-Factor Authentication

Salesforce has required all users with "System Administrator" role to use a Phishing Resistant MFA method.  PCT has accomplished this by using Yubi Keys (FIDO2).  The SAML response included attributes that let Salesforce know that Phishing Resistant MFA has been performed.