0

I am setting up a client with a SAML IdP and SP for their site, and one of their partners now needs to tie into this system. They use force.com to do so. We have SSO working as described in this doc:

https://help.salesforce.com/articleView?id=networks_auth_configure_saml.htm&type=5

The flow as-is:

  1. User on domain-A clicks "login"
  2. User is sent to the IdP with request payload
  3. User logs in or registers and is redirected back to domain-A
  4. User ends up at a link that offers them services from domain-Force
  5. User clicks link and is redirected to domain-Force login page
  6. User clicks the Log in with <sso idp option> button
  7. User is redirected to IdP, and IdP already has auth state for user so it redirects them back to domain-Force.
  8. domain-Force is happy and the user is logged in.

The change this 3rd party wants to make is to remove step 5, to have the force.com login page for their community automatically handle the logic of sending the saml request to the IdP.

Is there a way to configure this to happen? Can it be done with some customization to the CommunitiesLoginController they are using?

Improve this question
5
  • If you remove step 5, how does the system know where to redirect the user? Perhaps you can write out the steps in to-be state, it would help clarify.
    – identigral
    Commented Jun 6, 2019 at 2:24
  • Programmatically. There are multiple login pages created for this community for all of the other inbound routes users might take, so the primary /Login can be dedicated to this one task. Said simply: If the user is on /Login their ONLY next step is sending the IdP the auth request.
    – LeeZilla
    Commented Jun 7, 2019 at 3:20
  • Is the IdP in step 2 different from IdP in step 6?
    – identigral
    Commented Jun 10, 2019 at 17:06
  • Only in the source SP initiating the request. Otherwise it is doing the same workflow, authorizing a user to the second SP.
    – LeeZilla
    Commented Jun 11, 2019 at 16:19
  • If domain-Force is an SP that is linked to the IdP and the session exists at IdP from steps 2-3, you shouldn't be prompted for login in step 6. Perhaps the link in step 4-5 is "wrong" (it doesn't engage the IdP/SP on SF side) or the IdP/SP integration on SF side is not implemented correctly.
    – identigral
    Commented Jun 11, 2019 at 17:03

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .