4

We have setup Google login via OAuth for our Salesforce (Not SAML) and authentication via our custom domain page works fine. But as soon as we try to restrict our users to login only from our domain page (In Setup->Domain Management->My Domain->Login Policy: Prevent login from https://login.salesforce.com), this method for authentication fails when initiated from our custom domain, with the following error:

Problem Logging In
We can’t log you in because of an authentication error. For help, contact your Salesforce administrator.

When I go and visit the login history I notice the following entry associated with this failed login attempt:

Login Type: Third Party SSO
Status: Restricted Domain

As soon as I loosen that restriction, login via Google starts working again.

I've followed this guide to setup SSO: https://help.salesforce.com/articleView?id=sso_provider_google.htm&type=5

I've used this code for my registration handler: https://github.com/trineo/sfdc-rego-handler/blob/master/src/classes/GoogleAppsRegistrationHandler.cls

Improve this question
8
  • The oauth flow from google is likely redirecting the user back to login.salesforce.com/auth/sso... Change that url in your auth provider config to be yourdomain.my.salesforce.com/auth/sso...
    – Greg Grinberg
    Mar 29, 2018 at 21:13
  • @GregGrinberg Interesting thought. I don't see any reference to login.salesforce.com either on my google apis/services or in salesforce auth provider. can you point me to where you're referring to?
    – Reza S
    Mar 29, 2018 at 21:24
  • When you set up the authentication provider for Google in Salesforce, did you accept Salesforce's managed values or did you configure it manually? You likely just need to modify the endpoint URLs for the my domain. help.salesforce.com/…
    – Mark Pond
    Mar 29, 2018 at 21:58
  • @MarkPond I only have entered my consumer key, secret and registration handler, everything else was left as default
    – Reza S
    Apr 2, 2018 at 17:37
  • @RezaS what is the callback URL that you see when you go to the Auth Provider detail page that you have configured? It should be under Salesforce Configuration section on the AUth Provider page. Do you find something as: login.salesforce.com/services/authcallback/xxxxx/Google_OAuth
    – Jayant Das
    Apr 3, 2018 at 23:59

2 Answers 2

Reset to default
2
+25

This looks like to be an issue which was fixed with Summer '17, that may have resurfaced. Refer to this known issue here.

You may like to reach out to Salesforce support to verify and get details on this, if that's the case.

Update: The issue specifically seems to be in the SSO flow as if you login using the my domain url and use your salesforce credentials, it works fine even if "prevent login.." is checked. This could possibly be part of the issue that was fixed with Summer '17 only for my domain urls but not the SSO flow.

Improve this answer
1

What is the URL you entered in step 5 of the setup? If you used the sample URL that contains the 'login.salesforce.com' part, your login most likely fails when you prevent users from login in via this URL.

I would suggest replacing the login.salesforce.com part with your custom domain that you have configured and try again.

UPDATE: Based on the below comment it's probably not in step 5. Once you saved your Auth. Provider, it will provide you with the following URLs:

Test-Only Initialization URL
Single Sign-On Initialization URL
Existing User Linking URL
OAuth-Only Initialization URL
Single Logout URL

Those URLs must be specific to your my domain settings.

Improve this answer
3
  • step 5 talks about setting a URL suffix, not an actual URL (it has a 32 char limit). For us that's currently set to "Google"
    – Reza S
    Apr 9, 2018 at 19:41
  • @RezaS that's actually a good point. I'll update my reply.
    – Jannis Bott
    Apr 10, 2018 at 0:45
  • all those 6 domains are off of my custom domain @Jannis Bott
    – Reza S
    Apr 10, 2018 at 4:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .