I have configured an Elastic SSO Identity Provider, and added Salesforce as a Service Provider. I also configured a Custom Domain. When I access Salesforce custom domain on the browser, it properly redirects to the Elastic SSO Login page. But after login, Salesforce says "Unable to login using your identity provider."
I then go to Elastic SSO Transaction Log, pick up the SAML Response and paste it into Salesforce SAML Assertion Validator in the Single Sign On settings page. Here, I find the following error:
Unable to map the subject to a Salesforce.com user.
Of course, the two are different - My Salesforce ID (if I login directly using https://login.salesforce.com is email@example.com and in the Elastic SSO, it is firstname.lastname@example.org
How do I tell Elastic SSO that the name it should assert is email@example.com? Besides this, I also get the following errors in the SAML Assertion Validator page.
<p> 11. Validating the Signature</p> <p>Is the response signed? true</p> <p>Is the assertion signed? true</p> <p>The reference in the response signature is valid</p> <p>The signature in the assertion is not valid</p> <p>The reference in the assertion signature is valid</p> <p>Is the correct certificate supplied in the keyinfo? true</p> <p>Signature or certificate problems</p> <p>The signature in the response is not valid</p>
I am using a self-signed certificate for testing.