Data flow for SAML based SSO with salesforce for outlook

Question

We are planning to implement SAML based SSO for our salesforce org. Salesforce will be a service provider.

We are also using Salesforce for Outlook plugin. Can anybody explain how username and password flow between Salesforce and ADFS, when a user tries to login on 'Salesforce for Outlook' plugin.

I am primarily concerned about PASSWORD. How is it handled in this scenario.

Answer 1

If you have My Domain set up (and, if you are configuring SAML, you should!), you can configure Salesforce for Outlook with the domain (e.g. mycompany.my.salesforce.com). As described in the docs,

[...] click Change URL and pick the server to which you want to connect. If the server you want isn’t listed, select Other... and enter the URL, such as a custom domain used by your organization.

Now the plugin will use the custom URL to do OAuth, rather than the default login.salesforce.com. The Salesforce authorization server will recognize the incoming My Domain hostname, look up the org config, and redirect to the SAML identity provider (in your case ADFS) appropriately.

The process is well described in Single Sign-On for Desktop and Mobile Applications using SAML and OAuth.

Answer 2

There is no password flow between ADFS and Salesforce, its handled using cryptographic assertions of an XML document over SSL.

1. Outlook loads
2. Plugin reaches out to your mycompany.my.salesforce.com (as @metdaddy describes above)
3. Salesforce redirects the plugin to your local ADFS based on the config you set up (note, not identity details have been exchanged yet
4. User authenticates with username and password against your ADFS system.
5. ADFS prepares a cryptographically signed XML document containing the details of the users username/name/etc BUT WITHOUT THE PASSWORD and redirects the plugin to send it to Salesforce over SSL.
6. SAlesforce receives the cryptographically signed XML, validates it was signed by your ADFS 's private key with the public key you uploaded in the initial config. Now it knows it definitely came from your ADFS. It was also sent over SSL from the plugin and it is also secure from interception.
7. Salesforce returns the session ID to the plugin.
8. Plugin now uses the Salesforce APIs to integrate between Outlook and Salesforce.

In summary, ADFS sends a digitally signed, timestamped assertion of identity to Salesforce but retains the username/password within your network.