23

Question

When SSO has been configured for SAML 2.0 and a user's federation identifier has been populated, how do they get redirected to the Identity Provider's login page?

Background

I'm working to configure a Salesforce instance to use a 3rd party Identity Provider. I've uploaded their certificate and filled out their settings in setup->security controls->single sign-on settings. I've also created a test user with a federation identifier.

I'm now trying to test that the user gets redirected to the 3rd party identity provider when trying to access salesforce, but I'm stuck. I've tried going to the standard login page and entering my current username and password and that just logs me without going to the identity provider. I've also tried going to the salesforce login url from my SSO settings (https://login.salesforce.com/?saml=XXXXXXXXXXX), but that just sends me to the same page. I'm sure I'm misunderstanding how this works, but I'd think both of the above would somehow see that the user has a federation identifier and then validate their session with the identity provider. What am I doing wrong here?

ps - I'm a total dunce when it comes to SSO and have been trying to educate myself with the plentiful resources on developerforce and the broader web, but I'm still pretty green.

Improve this question
1
  • 2
    I think it would benefit everyone greatly if Salesforce were able to import an IdP's metadata file instead of this manual process. Really? Export SAML metadata as an SP but not import SAML metadata from a standard IdP? So much pain and suffering with service mismatches and out-of-band certificate processes, this is what the metadata exchange is designed to automate and avoid! – user3683 Aug 28 '13 at 19:12
18

You're trying to setup / use Service Provider (SP) Initiated SSO. In this case Salesforce is the SP and you've configured an external IdP to provide authentication.

SP Initiated Login works on Salesforce with My Domain. Additionally you will need to set up Salesforce for federated authentication on your IdP, by (at least in case of ADFS) importing the metadata which you export from the SSO Settings Screen in Salesforce.

You will need to set up My Domain, where you register a custom domain for your org, and there is a setting in My Domain where you choose the authentication provider as the IdP rather than the Salesforce login page. The very descriptive "My SAML IDP" option refers to the settings you configured in Security Controls->Single Sign-On Settings.

enter image description here

You then need to refer to your org by the My Domain URL, at which point Salesforce reads this configuration and redirects to the IdP for authentication, passing through a SAML Request. (i.e. login with the custom My Domain URL eg https://ralph-dev-ed.my.salesforce.com, so Salesforce knows that it needs to delegate authentication to your IdP). If you wanted to by pass the auto-redirect for users who aren't setup for federated authentication you can append /?login to your My Domain URL to override the SAML redirect (e.g https://ralph-dev-ed.my.salesforce.com/?login)

Once you've entered your credentials on the IdP login page, it posts a SAML Assertion to the Salesforce Assertion Consumer Service URL, which identifies the User either by UserName or Federation Id, based on what you've set up in your SSO Settings and lets you in.

Lastly, there is also a Summer 13 Known Issue which is preventing SP Initiated login from working on upgraded sandboxes, owing to a mismatch in the Assertion Consumer Service URL in the SAML Request that is sent to the IdP.

Also worth mentioning that Summer 13 brings support for multiple IdP's.

Improve this answer
5
  • Am I correct in assuming that this requires ALL user's to use the IdP setup in the my domain settings? Not sure if they look at whether the user has a federationId and sends them to the standard login page if not present. We'd like the admin users to NOT use SSO since the 3rd party IdP will only have credentials for standard users :( – Ralph Callaway May 15 '13 at 15:37
  • 4
    If you type in the MyDomain URL, then yes it redirects to the IdP Authentication page for all users. However, you can have a link on the IdP Authentication page to, so people could navigate to login.salesforce.com. To skip authentication via IdP and login via salesforce, you can append /?login to the My Domain URL, eg ralph-dev-ed.my.salesforce.com/?login – techtrekker May 15 '13 at 15:40
  • 1
    Awesome, the ?login is just what I was looking for. Wish I could double accept this answer. – Ralph Callaway May 15 '13 at 17:58
  • One more followup, am I correct in assuming that "My SAML IdP" refers to whatever I've set up in the Single Sign-On Settings page? – Ralph Callaway May 15 '13 at 18:48
  • 2
    Yessir. I would imagine this would change in Summer'13 given that you can set up multiple IdPs. – techtrekker May 15 '13 at 18:50
6

Note that in the current version (Winter 13), the Authentication Service option is now under 'Login Page Branding', and you specify the name of the SAML Setting you configured. See screenshot.

enter image description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.