0

BACKGROUND

When adding multiple IdP providers for SSO, the default /login page of an SFDC-based Community (screenshot below) would prompt the user to select an IdP from which to login.

enter image description here

Clicking any of the SSO buttons would SP-initiate the SSO flow with the chosen IdP.

QUESTION

I'd like to make the login process slightly more efficient by avoiding the IdP prompt in /login, and instead show the "Sign in with IdP" buttons on different parts of the Community. For example, I'd like the SSO buttons in an expandable dropdown on the global navigation bar (e.g., <c:sso_button name="azure" />, <c:sso_button name="my_company_idp" />, ...)

Is this possible? Does SFDC provide an API that I can use to create my own custom SP-initiating SSO buttons with a given IdP?

Improve this question
1
  • 1
    Shouldn't that be just an IdP initiated login? Where you have your IdP url configured on your button and rest your IdP takes care of redirecting to Salesforce after the assertion.
    – Jayant Das
    Commented Apr 27, 2018 at 17:58

2 Answers 2

Reset to default
0

You don't need any specific Salesforce APIs here to achieve what you have mentioned as:

"Sign in with IdP" buttons on other public-facing pages of the Community (for example the nav bar)

What you need here is an IdP initiated SSO to Salesforce. The excerpt below from this link explains this perfectly and maps exactly to what you are looking for:

In an IdP-initiated use case, the identity provider is configured with specialized links that refer to the desired service providers. These links actually refer to the local IdP's Single Sign-On Service and pass parameters to the service identifying the remote SP. So instead of visiting the SP directly, the user accesses the IdP site and clicks on one of the links to gain access to the remote SP.

The button that you want to expose on your public facing sites will be necessarily a link to your IdP authentication, which will then in turn redirect it to Salesforce after successful authentication.

Few references:

Improve this answer
3
  • The buttons in the above screenshot that are rendered in SFDC for each SAML config are certainly SP-initiated because the authentication request is issued by SFDC from https://<community>.force.com/saml/authn-request.jsp?.... I'm asking how I can create those SP-initiating SSO buttons myself so I can show them in other parts of my sfdc-based community.
    – Jan J
    Commented Apr 27, 2018 at 21:49
  • Yes they indeed are because you reach here only when you go through SP initiated login. However as I understand, you want to have buttons on sites external to this community and have them behave similar to what these do without being redirected to this page, then it has to be IdP initiated sso.
    – Jayant Das
    Commented Apr 27, 2018 at 22:26
  • 1
    I figured. I simply don't want my users to be redirected to /login first if I can show these buttons elsewhere on my community.
    – Jan J
    Commented Apr 27, 2018 at 23:00
0

Actually I know you asked that answer earlier and I also need the same functionality so, I am able to figure out salesforce provide API to get the details of SSO and to generate the URL for the SSO link as well. Might be helpful for others facing the same issue.

Following code, the sample will be helpful

String communityUrl = ''; String startUrl = ''; Auth.AuthConfiguration authConfig = new Auth.AuthConfiguration(communityUrl,startUrl); List samlPrvs = authConfig.getSamlProviders();

Returns the list of SAML-based authentication providers available for a community or Salesforce My Domain subdomain.

String sso = Auth.AuthConfiguration.getSamlSsoUrl(communityUrl, startURL, samlId) Returns the single sign-on URL for a community or Salesforce My Domain subdomain.

Salesforce API Link

Might be helpful for others facing the same issue.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .