Authentication on API calls with Federated SSO

Question

I'm looking to setup Salesforce using Federated SSO, and then make SOAP (or REST) calls from another application to the SF API. How do I authenticate in these API calls?

EDIT... I'm looking to authenticate the user in the API calls. I'm avoiding using a service account as I want audit trails to reflect changes for specific users.

Answer 1

You will need to set up a Connected App with the appropriate OAuth Scopes.

Configure the Connected App Permitted Users behaviour to Admin Approved Users (under Manage Apps), so that Users don't need to manually authorize the Connected App, unless you desire this behaviour.

You can use the SAML Bearer Flow to post a SAML Assertion (Containing the Client Secret and Key from the Connected App you configured above) to the OAUTH2 Endpoint, and obtain an access token.

• The Issuer must be the OAuth client_id or the remote access application for which the developer registered their certificate.
• The Audience must be https://login.salesforce.com or https://test.salesforce.com.
• The Recipient must be https://login.salesforce.com/services/oauth2/token or https://test.salesforce.com/services/oauth2/token.
• The Subject NameID must be the username of the desired Salesforce user.

This token can then be used for Authorisation in your REST Calls.

Answer 2

i'm also in the same situation but i would have some confirmation.

We have set up SSO for internal users (SAML 2.0) with Trustelem Cloud SSO and it's work great. In the configuration, the Issuer is a Trustelem url and EntityId is https://saml.salesforce.com

Now we want to use this SSO between our intranet and Salesforce. Users on the intranet are also logged thanks to the SSO. In the intranet, we want to use Chatter API in order to query for exemple, last posts on groups.

So i need to configure a connected app and enable SAML on it ? I'm a little confused about what i need to fill.

• Entity Id : the same url configured on the SSO ? https://saml.salesforce.com ?
• ACS URL : ?? Does i need to ask something to Trustelem ?
• Subject Name : We use FederationId from the SSO, i supposed i need to use the same ?
• Name ID Format ??
• IDP Certificat : same certificate used on my SSO (field Request Signing Certificate) ?
• Issuer : the Trustelem URL from my SSO configuration ?

So when all this will be set up, the intranet will log on salesforce using FederationId and the token of the intranet connection ? This will call Trustelem and Salesforce will give back a token to call the Chatter API ?

Thank's in advance.