21

When an HTTP request arrives at Salesforce, if there is no valid session ID supplied (or the request is for a login page), Salesforce first examines the requested domain. If the requested domain is a My Domain (i.e. of the form https://mycompany.my.salesforce.com/), then we look up the associated org and check whether SAML (or, from Winter '13, an ...


18

You're trying to setup / use Service Provider (SP) Initiated SSO. In this case Salesforce is the SP and you've configured an external IdP to provide authentication. SP Initiated Login works on Salesforce with My Domain. Additionally you will need to set up Salesforce for federated authentication on your IdP, by (at least in case of ADFS) importing the ...


11

To successfully implement SSO so that it works with Salesforce1, you must make sure that the server is configured correctly to support the idosyncrocies of Salesforce1, which is more stringent than other clients (e.g. every major web browser on the market). This answer documents some common mistakes and outlines how to correctly configure AD FS. AD FS and ...


8

Yes, you can SSO into one or more target Salesforce orgs via OpenID Connect from Google: http://help.salesforce.com/apex/HTViewHelpDoc?id=sso_provider_openid_connect.htm&language=en_US A couple of helpful blogs that walk you through this http://dice.neko-san.net/2014/01/using-google-as-an-open-id-connect-authentication-source-for-salesforce-com/ http:...


7

You will need to set up a Connected App with the appropriate OAuth Scopes. Configure the Connected App Permitted Users behaviour to Admin Approved Users (under Manage Apps), so that Users don't need to manually authorize the Connected App, unless you desire this behaviour. You can use the SAML Bearer Flow to post a SAML Assertion (Containing the Client ...


6

Yes, you can use Federated Authentication (e.g. SAML) and Delegated Authentication (DA) in parallel. The Mobile CRM product prompts the user for username and password - they give their enterprise password, which is be verified by the DA mechanism - a SOAP message is sent to an endpoint in the enterprise, which validates the username/password. When SAML is ...


6

Note that in the current version (Winter 13), the Authentication Service option is now under 'Login Page Branding', and you specify the name of the SAML Setting you configured. See screenshot.


5

If I understand your question correctly, this should be the approach you should be following. Force.com sites do support SSO using SAML. You need to provide the following info for your identity provider Organization ID Portal ID Sites URL The following must be added as attributes to the SAML assertion sent from your identity provider:...


4

http://wiki.developerforce.com/page/How_to_Implement_Single_Sign-On_with_Force.com Refer the above article and thats the one of the best articles i have read on this . You will first need to raise a case with salesforce to enable delegated authentication for your org. https://help.salesforce.com/apex/HTViewHelpDoc?id=sso_delauthentication_configuring.htm&...


4

The RelayState parameter is defined here The important thing to note is that it has now been changed as mentioned When a service provider initiates login, the default RelayState is now /. In previous releases, the default RelayState was /home/home.jsp. It is required that your IDP echoes this back correctly Ensure your IdP is properly receiving the ...


3

TL;DR. It's impractical. Anyone that can deploy code to an org must be an administrator. The "Author Apex" permission requires View Setup and Configuration and Modify All Data-- in other words, they are full administrators. They can see all code, all fields, and all records in the org. There are ways to limit this effect, such as creating a sandbox and ...


3

As I see you're already looking at the main Help documentation covering SAML and SSO, the first thing I'm going to do before attempting to answer any of your questions is refer you to another document: the Single Sign-On Implementation Guide as an additional resource. I want Salesforce to be the "master" user directory among various "child" external apps....


2

1.Make sure your API users does not have Federated Id populated .In other terms leave that as blank . 2.In My domain make sure , Prevent login from https://login.salesforce.com option is unchecked so users can use login.salesforce.com to login .


2

Unfortunately, you cannot segment Class/Page security the way you specify. If you have access to develop classes/pages, you have access to all classes/pages. There are a few things you can do to mitigate this, but likely none of those will be a silver bullet. 1) You can create separate orgs for each business unit and integrate the common data among all of ...


2

It's certainly possible to use the same Federation ID for multiple User accounts in different Orgs. If a user has 2 different accounts in the same Org, then the same Federation Id can't be used for two accounts, since how would SSO know which one you wanted to log in to?


2

Delegated Authentication is specific to Salesforce only (not industry standard) where external Webservice only returns True and False saying Authentication is complete or not. However, in SP initiated SSO, IDP may use SAML protocol. Sometime back I had written blog post and Video tutorial on SAML, you may like to check this - http://www.jitendrazaa.com/blog/...


2

This option is useful for organizations who want to apply strict domain policies. Moreover we have seen organizations going for Single-sign on policies going for this.


2

According to your UseCase (external service first authenticates users and those users will automatically logged in to Salesforce Community). You need to use Authentication Providers. An authentication provider lets your users log in to your Salesforce org using their login credentials from an external service provider. Salesforce provides authentication ...


2

You can only use one value for the Federated ID. The login ID that was provided to the authentication server does not need to be the ID that is presented to Salesforce. Most systems have a concept of a UUID or GUID that identifies the user logging in uniquely, no matter which login method they use. The trick here is that you simply need to configure that ...


1

Disclaimer: i work for a company that does that exactly (Coveo) . And yes, you are able to do so with elastic search as well, however, if you are going to integrate such functionality within a community in Salesforce, there’s quite a bit of coding involved, and considering how often the platform has releases, there’s quite a bit of maintenance to do as well.


1

Thanks for comments and inputs, figured out finally! Below setting in SSO only prevents user logins through UI and our API logins remains unaffected, i.e even after enforcing 'Prevent login from test.salesforce' we are still able to make API calls to that end point, i believe this setting is not applicable to API calls and we able to use salesforce username ...


1

You need to add the site parameter to your SSO URL. https://login.salesforce.com/services/auth/sso/org/suffix?site=https%3A%2F%2Fmy.force.com%2F Reference - Using the Site Parameter


1

For users who do not have Federated IDs populated, will they be able to log in? Would they use Salesforce usernames/pwds? Yes, they'd be able to login via login.salesforce.com with Salesforce usernames and passwords. It is possible to prevent login via the standard login screen with a bit of a hack - you can ask support to turn on delegated ...


Only top voted, non community-wiki answers of a minimum length are eligible