7

I'm struggling to understand basic Single Sign-On concepts and how to design a Salesforce implementation.

I want Salesforce to be the "master" user directory among various "child" external apps. That means Salesforce is the SSO identity provider, and the child apps are the service providers, correct?

Is it sufficient to enable the identity provider feature in Setup, or do I need the Identity Connect product as well?

If I create a customer portal or community user in Salesforce, will that user account be automatically created in all the service provider apps? Can I limit the auto creation to certain types or profiles of portal/community users?

If the user is not auto created and I have to create manually in the service provider apps, how does SSO know that the manually created users are related to the Salesforce user?

The example in Help mentions populating the Federation ID field in the Salesforce user record with the Google apps user. I don't understand that - how can you have multiple service provider apps linked to the Salesforce user if there is only one Federation ID? http://help.salesforce.com/HTViewHelpDoc?id=identity_provider_examples.htm&language=en_US#sp_google_example_enabling_user

3

As I see you're already looking at the main Help documentation covering SAML and SSO, the first thing I'm going to do before attempting to answer any of your questions is refer you to another document: the Single Sign-On Implementation Guide as an additional resource.

I want Salesforce to be the "master" user directory among various "child" external apps. That means Salesforce is the SSO identity provider, and the child apps are the service providers, correct?

This scenario is illustrated in the 2nd diagram on About Identity Providers and Service Providers. Yes, Salesforce would be the identity provider and and other sites the user visited would be service providers.

Is it sufficient to enable the identity provider feature in Setup, or do I need the Identity Connect product as well?

For the use you describe where Salesforce is the Identity Provider, and its not a situation where your own company's server log-in is the Identity provider sending it to Salesforce via SAML you should only need to enable the identity provider feature from setup. It sounds as though you also don't plan to use OpenID.

If I create a customer portal or community user in Salesforce, will that user account be automatically created in all the service provider apps? Can I limit the auto creation to certain types or profiles of portal/community users?

You'll need to create the Customer and other types of Portal Users from your contacts unless you enable Self Registration for each portal. Until you create the Users, as far as SF knows, they're just contacts. You'll want to look at the communities documentation to learn more about your options for creating users.

If the user is not auto created and I have to create manually in the service provider apps, how does SSO know that the manually created users are related to the Salesforce user?

It does that when the user logs in and is authenticated. Their authentication string is sent to the app which tells the app who they are.

I think the Google Apps example probably doesn't apply to your situation. A Google log-in ID would typically apply to more of an OpenID scenario which isn't at all what you intend to configure according to what you've described.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.