1

As it says on the tin. I'm trying to set up SAML based federated authentication connecting to an Active Directory server in my developer org, before I try to deploy this to my users. I don't see the 'Is Single Sign-On enabled' checkbox on the profile. I do however see it on my sandbox. Is there something I need to enable in my org, other that activating Single Sign-On, to see this option? Or is it not necessary for federated authentication, only for delegated authentication?

Improve this question

1 Answer 1

Reset to default
0

If you're using Salesforce Identity Connect, you don't need to do anything with profiles. Identity Connect will hold them in a map for you. It does the following:

  • Profiles. The Profile to AD Group mapping maps Salesforce profiles to Active Directory groups. A default profile mapping is required. If a user is not a member of any of the groups that are mapped in this section, he is mapped to the default Salesforce profile.

  • User Roles. The User Role to AD Group mapping maps Salesforce user roles to Active Directory groups.

  • Permission Sets. The Permission Set to AD Group mapping maps Salesforce permission sets to Active Directory groups. The permission sets displayed here are those that have been configured for your Salesforce organization.
  • Salesforce Groups. The SF Group to AD Group mapping maps groups defined within Salesforce to Active Directory Groups.
Improve this answer
2
  • Unfortunately I'm not using Identity Connect. I'm using Federated Authentication and trying to follow these instructions. I however got this finally working, without having the checkbox in effect. I worked on this for a few hours alongside my AD admin and I can at least testify that this doesn't' have to be a chore if one follows the documentation here (developer.salesforce.com/page/…). It's a bit harder if you make your changes and have to wait for the AD admin to do their work.
    – akarnid
    Commented Jun 11, 2015 at 15:54
  • I'm going to mark this answer as the right answer, since it seems Identity Connect would have been the best option. Maybe we will switch to that in the future. But for now, SAML-based authentication works for us.
    – akarnid
    Commented Jun 12, 2015 at 8:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .