0

BACKGROUND

When adding multiple IdP providers for SSO, the default /login page of an SFDC-based Community (screenshot below) would prompt the user to select an IdP from which to login.

enter image description here

Clicking any of the SSO buttons would SP-initiate the SSO flow with the chosen IdP.

QUESTION

I'd like to make the login process slightly more efficient by avoiding the IdP prompt in /login, and instead show the "Sign in with IdP" buttons on different parts of the Community. For example, I'd like the SSO buttons in an expandable dropdown on the global navigation bar (e.g., <c:sso_button name="azure" />, <c:sso_button name="my_company_idp" />, ...)

Is this possible? Does SFDC provide an API that I can use to create my own custom SP-initiating SSO buttons with a given IdP?

  • 1
    Shouldn't that be just an IdP initiated login? Where you have your IdP url configured on your button and rest your IdP takes care of redirecting to Salesforce after the assertion. – Jayant Das Apr 27 '18 at 17:58
0

You don't need any specific Salesforce APIs here to achieve what you have mentioned as:

"Sign in with IdP" buttons on other public-facing pages of the Community (for example the nav bar)

What you need here is an IdP initiated SSO to Salesforce. The excerpt below from this link explains this perfectly and maps exactly to what you are looking for:

In an IdP-initiated use case, the identity provider is configured with specialized links that refer to the desired service providers. These links actually refer to the local IdP's Single Sign-On Service and pass parameters to the service identifying the remote SP. So instead of visiting the SP directly, the user accesses the IdP site and clicks on one of the links to gain access to the remote SP.

The button that you want to expose on your public facing sites will be necessarily a link to your IdP authentication, which will then in turn redirect it to Salesforce after successful authentication.

Few references:

  • The buttons in the above screenshot that are rendered in SFDC for each SAML config are certainly SP-initiated because the authentication request is issued by SFDC from https://<community>.force.com/saml/authn-request.jsp?.... I'm asking how I can create those SP-initiating SSO buttons myself so I can show them in other parts of my sfdc-based community. – jmrjulian Apr 27 '18 at 21:49
  • Yes they indeed are because you reach here only when you go through SP initiated login. However as I understand, you want to have buttons on sites external to this community and have them behave similar to what these do without being redirected to this page, then it has to be IdP initiated sso. – Jayant Das Apr 27 '18 at 22:26
  • I figured. I simply don't want my users to be redirected to /login first if I can show these buttons elsewhere on my community. – jmrjulian Apr 27 '18 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.