2

We have a new customer self service community that we're trying to integrate with our existing external website. Is there a way to allow users access to community and access cases and knowledgebase without having to log in to Salesforce if they're already logged into the website? Do we need to store all user credentials on Salesforce?

Improve this question

1 Answer 1

Reset to default
2

See the Salesforce Communities Implementation Guide, starting on page 119, or Configure SAML for Communities. I won't include the entire text verbatim, as it's far too long for an answer here, but what follows is a summary. I suggest reading the manual for more details. You can always find the latest version by searching your favorite search engine for "Salesforce Communities Implementation Guide" or "Configure SAML for Communities" from the Help & Training window.

You can configure Single Sign On for your community, which basically means that your external website authenticates the user via SAML authentication. The SAML assertion needs to include information about the community being logged in to, and a unique identifier that will be used to determine which user is logging in. No passwords are exchanged during this process. Users can also start from the community page if they have the URL, and authentication with your external website using the credentials from that site.

It's actually pretty straightforward in most cases. For example, if you set up an Active Directory Federated Services (AD FS) server that's Internet-facing, you could have your external site and salesforce.com share the same login mechanism. If they're already logged in to the AD FS server from a previous session, they can bounce between your external site and salesforce.com seamlessly without logging in again. There's other ways you can do this as well, but it really depends on the capabilities of your external site.

If you get stuck on a specific step of this process, please feel free to ask more questions, and we'll assist you as best as we can. The documentation is already pretty explanatory, but I've found that the actual implementation can get tricky (it took me three months to get SAML working correctly the first time). There's a few tips that might help you from my previous Q&A on the topic of using AD FS with salesforce.com.

Improve this answer
4
  • Are you familiar with the licensing implications? Am I correct in assuming that we will need Salesforce Identity licenses?
    – Mossi
    Commented May 22, 2019 at 6:26
  • @Mossi Salesforce Identity is a specific SSO solution provided by salesforce.com. You are free to not use Identity and choose a different mechanism instead. I set up a solution purely in AD FS without Identity, for example.
    – sfdcfox ♦
    Commented May 22, 2019 at 8:43
  • Did you need your AD users to pre-exist in Salesforce? According to the "SAML Single Sign-On Settings" page it seems the answer is yes since SAML Identity Type requires a Salesforce User identifier to match against.
    – Mossi
    Commented May 24, 2019 at 1:01
  • @Mossi you can match based on Federation Id, and the user need not exist beforehand if you enable JIT provisioning. However, you will need extra licences available if you enable this feature.
    – sfdcfox ♦
    Commented May 24, 2019 at 1:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .