1

Summary: I want to use Salesforce as an identity provider to allow people to log into my app, regardless of what salesforce org they use.

I've created an app in PHP that uses SimpleSAMLphp to implement Single Sign-on as the Service Provider with Salesforce as the Identity Provider. In my Salesforce developer edition I've set it up as an identity provider, created a certificate, and created a Connected App configured with SAML and everything works with my PHP app. I can log in using Salesforce and the PHP app authenticates and returns attribute information for the user. Great.

Now I want to make this app available to users of other Salesforce orgs. So I created a managed package, included my Connected App, and uploaded it.

I created a second developer account to test this all out. Installed the package into the new account using the url, enabled access to it for the admin user. Great.

But here's the hangup...

When I try to log into my PHP app, it redirects me to the login screen for the 1st developer account (under which the connected app and package were initially created). Of course I can't log in there with the credentials for the 2nd dev account.

In theory I can see why it would want to do this... the Identity Provider configuration was created in that 1st developer account.

I've tinkered with adding an Issuer ID with the new dev account but when the PHP app tries to use it as an IdP, Salesforce errors out "Unable to resolve request into a Service Provider". Makes sense since this org is not configured as an IdP.

What piece am I missing here to make this app accessible to other orgs?

This question seems to be related but I can't quite make sense of the answer

This linked article also seems relevant

Improve this question

1 Answer 1

Reset to default
0

I suspect the entityID of the connected app you installed through the managed package is the same as the url for org one. This is why the service is taking you back.

This assumes you want the org this package is installed in to act as a new IDP.

Improve this answer
5
  • Thanks @Rick. This makes sense but I don't see any other way to set it up. Yes the org the package is installed into should be the IdP for anyone using that org, but how can I make my app know to use that org?
    – Maddix
    Apr 22, 2021 at 4:34
  • I don't think you can distribute connected app this way. Maybe some sort of wizard that instructs the user to stand up their own? I don't understand why you would want the customer to be another identity provider? N identity providers to 1 service provider?
    – Rick Schmidt
    Apr 22, 2021 at 12:55
  • Maybe that's not the way. I don't know what is possible, but in general what I want is for users to be able to log into my app using Salesforce, regardless of what org they use.
    – Maddix
    Apr 22, 2021 at 13:41
  • I don't think you want IDP or SP. This is an oauth (authorization) flow not authentication. Either the org you build the package in or a separate org will host the connected app. When users sign in to your php app they will be redirected to their instance (login/test.salesforce.com) and will go through the web-server oauth dance. help.salesforce.com/… After authorizing your connected app is "installed" in their org where they can admin access similar to how you can control SFDX CLI access.
    – Rick Schmidt
    Apr 22, 2021 at 13:54
  • Aha, I wasn't aware of the distinction between authentication and authorization. That sounds like it could be the key to this. I'll dig into that.
    – Maddix
    Apr 22, 2021 at 14:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .