I need to enable Single Sign On for Salesforce Marketing Cloud account where Identity Provider will be a third party and Marketing Cloud will be the Service Provider. I already got SSO Metadata option enabled for my account. I however, need an Entity ID and Federation ID.
I am not clear about how to carry the entire process. If anyone of you guys has done SSO enabling for Marketing Cloud, please share steps.
We don't have a very helpful documentation on enabling Marketing Cloud SSO. We do have some really useful information on the background of the process but once we start the implementation, there are various questions that I did not find much help on. I have successfully implemented SSO for my account and would like to share the practical steps that need to be carried out while doing so.
1) Get SSO Metadata enabled for your account. When you go to Admin-> Data Management -> Key Management -> Create a new Key, you don't have SSO Metadata enabled for your account. Although it does not require any licensing or extra cost to get it enabled, we need to raise a Salesforce Support ticket and they enable it for our account.
2) To enable SSO, we need to have an Identity Provider(IDP) and a Service Provider(SP). In my case, IDP was a third party and Marketing Cloud acted as SP. An important thing to keep in mind is that SSO enabling in MC is IDP initiated. SP initiated feature is not available yet (as confirmed by Support team and they have taken this as a feature enhancement request).
3) IDP will provide a metadata containing Entity ID value, Name-ID Format, Certificate, Single Sign On Service Location, Type of Binding, etc. Now, as per the official documentation provided by Salesforce, https://help.salesforce.com/articleView?id=mc_overview_create_a_key.htm&type=5 , you need to create a key. I will not elaborate on the different methods of creating key as these are already nicely explained in the documentation.
4) Once this Key is created, you will see a link getting generated. Note that in the documentation, they have mentioned that SAML SP Metadata gets generated. You need to share this link with your IDP so that they can redirect SSO to this link.
5) Now enable MC as a SP. Follow this: https://help.salesforce.com/articleView?id=mc_overview_administration_configure_marketing_cloud_as_service_provider.htm&type=5
6) Now user level SSO enabling needs to be carried out. This has to be done user-by-user and can't be done for all users at once. Enable for one user by editing the user and click the Single Sign-On Enabled checkbox. In the Federation ID box, enter the unique ID that is used by your third party (which can be a LAN ID or a user ID).
7) Hit that link (the one that got generated on creation of key) and enter the user's SSO credentials (the third party's credentials and not the Marketing Cloud account's one) and that SSO enabled user should be able to login into SFMC.
8) Once successfully tested, enable all the required users for SSO.
I hope this helps.
