Configure a LinkedIn Authentication Provider

Set Up a Registration Handler

To use an authentication provider for single sign-on, you must create a registration handler. The registration handler creates users and updates existing users who access Salesforce via the identity provider. You can set up a registration handler with Apex or Flow Builder. For more information, see Create an Authentication Provider Registration Handler.

Here's an example Apex registration handler for the LinkedIn authentication provider. This registration handler assumes that the requested scopes include r_liteprofile and r_emailaddress. It also assumes that the users are logging in to a customer portal.

Note The default registration handler requires email. Use this request to retrieve the currently authenticated member's email address. GET https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~)).

Example

//TODO:This auto-generated class includes the basics for a Registration
//Handler class. You will need to customize it to ensure it meets your needs and
//the data provided by the third party.
global class LinkedInRegHandler implements Auth.RegistrationHandler {
    //Creates a Standard salesforce or a community user
    global User createUser(Id portalId, Auth.UserData data) {
        if (data.attributeMap.containsKey('sfdc_networkid')) {
            //We have a community id, so create a user with community access
            //TODO: Get an actual account
            Account a =[SELECT Id FROM account WHERE name = 'LinkedIn Account'];
            Contact c = new Contact();
            c.accountId = a.Id;
            c.email = data.email;
            c.firstName = data.firstName;
            c.lastName = data.lastName;
            insert(c);
            //TODO: Customize the username and profile. Also check that the username 
            //doesn't already exist and possibly ensure there are enough org licenses
            //to create a user. Must be 80 characters or less.
            User u = new User();
            Profile p =[SELECT Id FROM profile WHERE name = 'Customer Portal Manager'];
            u.username = data.firstName + '@sfdc.linkedin.com';
            u.email = data.email;
            u.lastName = data.lastName;
            u.firstName = data.firstName;
            String alias = data.firstName;
            //Alias must be 8 characters or less
            if (alias.length() > 8) {
                alias = alias.substring(0, 8);
            }
            u.alias = alias;
            u.languagelocalekey = UserInfo.getLocale();
            u.localesidkey = UserInfo.getLocale();
            u.emailEncodingKey = 'UTF-8';
            u.timeZoneSidKey = 'America/Los_Angeles';
            u.profileId = p.Id;
            u.contactId = c.Id;
            return u;
        } else {
            //This is not a community, so create a regular standard user
            User u = new User();
            Profile p =[SELECT Id FROM profile WHERE name = 'Standard User'];
            //TODO: Customize the username. Also check that the username doesn't
            //already exist and possibly ensure there are enough org licenses
            //to create a user. Must be 80 characters or less
            u.username = data.firstName + '@salesforce.com';
            u.email = data.email;
            u.lastName = data.lastName;
            u.firstName = data.firstName;
            String alias = data.firstName;
            //Alias must be 8 characters or less
            if (alias.length() > 8) {
                alias = alias.substring(0, 8);
            }
            u.alias = alias;
            u.languagelocalekey = UserInfo.getLocale();
            u.localesidkey = UserInfo.getLocale();
            u.emailEncodingKey = 'UTF-8';
            u.timeZoneSidKey = 'America/Los_Angeles';
            u.profileId = p.Id;
            return u;
        }
    }
    //Updates the user's first and last name
    global void updateUser(Id userId, Id portalId, Auth.UserData data) {
        User u = new User(id = userId);
        u.lastName = data.lastName;
        u.firstName = data.firstName;
        update(u);
    }
}

View LinkedIn Scopes

Set Up a LinkedIn App

1. Sign in to your developer account on LinkedIn.
2. From LinkedIn, click your profile picture at the top, and select My Apps.
3. Click Create App.
4. Enter the app settings.
5. Note the client ID and client secret.

Define a LinkedIn Provider in Your Salesforce Org

1. From Setup, in the Quick Find box, enter Auth. Providers, click Auth. Providers, and then click New.
2. For the provider type, select LinkedIn.
3. Enter a name for the provider.
4. Enter the URL suffix, which is used in the client configuration URLs. For example, if the URL suffix of your provider is MyLinkedInProvider, your SSO URL is similar to https://mydomain_url or community_url /services/auth/sso/MyLinkedInProvider.
5. For Consumer Secret, use the LinkedIn client secret.
6. To use an Apex registration handler, take these steps.
   1. For Registration Handler Type, select Apex.
   2. For Registration Handler, select an existing Apex class that implements the Auth.RegistrationHandler interface. Or, to create an template for the registration handler, click Automatically create a registration handler template. Edit this class later, and modify the default content before using it.
7. To use a flow for your registration handler, take these steps.
   1. For Registration Handler Type, select Flow.
   2. For Registration Handler, select an existing flow of the Identity User Registration flow type.
   3. Select a default profile. A default profile is required to run the registration handler. If you don't specify a default profile here, set the default profile in the flow itself.

      If you use the Authentication Provider User Registration flow template, the profile that you set here is automatically stored in the defaultProfileId variable.

   4. Select a default account. If you use your authentication provider for Experience Cloud sites, this account stores new internal users.

      If you use the Authentication Provider User Registration flow template, the profile that you set here is automatically stored in the defaultAccountId variable.

8. For Execute Registration As, select an execution user to run the Apex class or flow. The user must have the Manage Users permission.

   Execute Registration As provides the context in which the registration handler runs. In production, you typically create a system user for the Execute Registration As user. This way, operations performed by the handler are easily traced back to the registration process. For example, if a contact is created, the system user creates it.

9. Optionally, set these fields:
   • For Authorize Endpoint URL, enter https://www.linkedin.com/oauth/v2/authorization.
   • For Token Endpoint URL, enter the OAuth token URL from LinkedIn. For example, https://www.linked.com/oauth/v2/accessToken. For more information, see Authenticating with OAuth 2.0 Overview.
   • To change the values requested from LinkedIn’s profile API, enter the User Info Endpoint URL. For more information, see Profile API. The URL must start with https://api.linkedin.com/v2/me, and the requested fields must correspond to the requested scopes.
   • For Default Scopes, enter a supported value or space-separated values that represent the information you get from LinkedIn.
   • If you enter a consumer key and consumer secret, the consumer secret is included in SOAP API responses by default. To hide the secret in SOAP API responses, deselect Include Consumer Secret in SOAP API Responses. Starting in November 2022, the secret is always replaced in Metadata API responses with a placeholder value. On deployment, replace the placeholder with your consumer secret as plain text, or modify the value later through the UI.
   • For Custom Error URL, enter the URL for the provider to use to report any errors.
   • For Icon URL, add a path to an icon to display as a button on the login page for a site. This icon applies to an Experience Cloud site only. It doesn’t appear on your Salesforce login page or My Domain login URL. Users click the button to log in with the associated authentication provider for the site. Specify a path to your own image, or copy the URL for one of our sample icons into the field.
   • To use a portal for LinkedIn users, select the portal from the Portal dropdown list.
10. To use the Salesforce multi-factor authentication (MFA) functionality instead of your identity provider’s MFA service, select Use Salesforce MFA for this SSO provider. This setting triggers MFA only for users who have MFA applied to them directly. For more information, see Use Salesforce MFA for SSO.
11. Save your work.

Update Your LinkedIn App

Test the SSO Connection

Add the Authentication Provider to Your Login Page