Google Apps & Salesforce - SAML SSO

Question

If I'm using Salesforce as the Identity Provider to log in to my Google Apps email, what happens when Salesforce wants to verify my identity by emailing a login verification code?

As I think about it:

• I can't log in to Salesforce b/c I don't have the verification code
• I can't get the verification code because I need to log in to Salesforce to access my email.

I'm sure there's a work-around for this, but don't see anything in the docs and would want to resolve this before considering an implementation. Have you run into this situation?

Answer 1

Another option, that doesn't involve opening IP ranges, is to enable SMS Identity Confirmation by navigating to Your Name | Setup | Security Controls | Session Settings and checking Enable SMS-based identity confirmation.

Answer 2

I don't have an elegant solution, but I have a solution nonetheless. You can remove the requirement for verification codes by adding your known trusted network IP ranges (Setup > Security Controls > Network Access) or by contacting salesforce.com support and getting the verification process disabled.

You can only enter small IP-ranges manually so if your users are logging in from the public internet you'd need to add every range possible. This could be time consuming but there is an app for that!

Answer 3

If you have Enterprise/Platform or Unlimited edition, you can enter a large trusted IP range (eg: 0.0.0.0 - 255.255.255.255) in your Profile via:

Setup -> Manage Users -> Profile -> Click the profile you use -> in the related list at Login IP Ranges, click new, and enter the large IP range.