I am helping a client that needs to connect their partner portal, a Salesforce Partner Community. They need to setup an SSO for their partners from the partner portal into another web application using SAML. We are familiar with enabling Salesforce as an IdP for internal users, but not for partners. Can someone tell us how to setup and configure a Salesforce Partner Community as a SAML IdP?
The process is very much similar to how you set up for Internal Users except that you need to replace with Community URLS .
Lets look at step by step the mechanism to accomplish the same .For simplicity I am taking another winter 17 pre release org as a SP (Service Provider)
Set Up a Partner Community in Salesforce(This is your IDP org) .Not going to detail this but should be straight forward
Download the Self Signed Certificate from your IDP org .Your IDP org is where you have set up partner community .Navigate to
Setup | Security Controls | Identity Provider
Click on Download Certificate button
You will clearly see for your Partner Community there will be Discovery EndPoint URL .Carefully Note this down as this will be needed by your Service Provider .Also note down the issuer
Lets go to the service provider screen .In my example its another salesforce Instance (Winter 17 pre release org ).
Set up | Security Control | Single Sign On Settings
Carefully note two things
1.The issuer was obtained from IDP .
2.The IDP login URL is of one we noted in step 2 from IDP
3.We have uploaded the certificate which we downloaded in previous step
Create a Connected App in IDP and allow the partner community profile for the connected app
Carefully note that I have configured ACS URL which was provided by the service provider in previous step
Once your connected app is save and when you click on Detail link of the the Connected App ,for every community you will get an IDP intitated URL
The IDP initiated login URL is what you need to put on a tab or visualforce .You will then see that User is redirected to the SP once user clicks on the IDP initiated URL without having to log into the SP org .