We are working on a requirement where "my application" will act as Identity Provider and "Salesforce" as Service Provider. Its a IDP initiated SSO(SAML 2.0 Browser POST). My question is what is that need to configure and how to configure Salesforce as service provider? Any help would be greatly appreciated.

P.S : I'm using Salesforce 30 day trail version to do this PoC.

Thanks, Jagadeesh.K

1 Answer 1


Following steps can be followed to enable Salesforce as a Service Provider.

  1. Enable My Domain in Salesforce
  2. You need to download Certificate from your IDp application. For testing purpose, you can use Axiom application to act as a temporary IDp.
  3. Enable SSO in Salesforce
  4. Configure SSO in Salesforce by providing various values like shown in below image. These values mostly depends on IDp you are using.
  5. From IDp, you can launch Salesforce using "Salesforce Login URL" automatically generated in SSO configuration page.

enter image description here

You can refer this blog post where it explains how Axiom can act as IDp or this post where Salesforce acts as IDp as well as Service Provider.

  • Hi Jitendra. Thanks for quick turn around and the info. I have two questions (1) Where can we add ACS url, Single logout url and any custom error url? (2) When do we use connected apps?
    – jks
    Commented Mar 17, 2016 at 17:27
  • The reason for asking about connected apps is because I see there are some SAML configurations mentioned like ACS url, Single logout url and custom error url. So, wanted to know which one I need to use, either Single sign on settings in Security or Connected Apps?
    – jks
    Commented Mar 17, 2016 at 17:44
  • would suggest to start with Single Sign On Setting. If you are using Auth providers then Connected App would be useful Commented Mar 17, 2016 at 18:09
  • Thanks for the info. I just started Single sign on settings using your website guideline and it worked :) But what I didn't understand here is, There is no mention about ACS url and single log out url entries. so, in this case, on which url, SAML assertion will posted to and on which URL, Salesforce will consume SAML assertion?
    – jks
    Commented Mar 17, 2016 at 18:22
  • ACS URL is used in Connected apps and it is URL of external application which want access. IDp in SSO uses "Salesforce Login URL" specified in endpoint section to send SAML assertion. Commented Mar 17, 2016 at 19:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .