[SalesForce] Is a trigger on User the best way to add permission sets for Community Users

I started reading about the RegistrationHandler interface but that is designed to allow the overall authentication and User creation process to be varied.

In a Community, users can self-register (where they are tied to an Account and Profile as part of the self-registration process) and I want to assign several permission sets when they do. Based on the Profile and Permission Objects ERD it looks like adding PermissionSetAssignment records in a User trigger would do the job. Are there any gotchas with that approach?

Here is one inconclusive post on the subject Apex to Assign Skuid License and Permission Set.

PS

Duh access rights may get in the way: hard to know what profile the self registration is running under…

Best Answer

For self registration without SSO

Try ConfigurableSelfRegHandler Interface

After the visitor fills out the sign-up page and submits it, the handler is invoked to create a community member with the information that the visitor supplies. If the registration process requires email or phone verification, the verification process finishes before the Auth.ConfigurableSelfRegHandler.createUser is invoked. If verification isn’t required, createUser is invoked when the visitor submits the page.

Return Value Type: Id

Returns an identifier for the created User object. Auth.ConfigurableSelfRegHandler inserts a user and then returns the ID of that user.

So you can create the user assign the permission set and return the user Id.

For SSO via SAML

Check out the SamlJitHandler Interface.

While provisioning the user, you can add the necessary permission sets.

createUser(samlSsoProviderId, communityId, portalId, federationId, attributes, assertion) Returns a User object using the specified Federation ID. The User object corresponds to the user information and may be a new user that hasn’t t been inserted in the database or may represent an existing user record in the database.

The bolded text indicates that you can insert the user in your own method, add the perm set and then return the user you created.

For SSO Via Facebook etc.

As you pointed out, RegistrationHandler is very similar but it works for third party login apis:

Salesforce provides the ability to use an authentication provider, such as Facebook© or Janrain©, for single sign-on into Salesforce

Related Topic