Hot answers tagged

21

When an HTTP request arrives at Salesforce, if there is no valid session ID supplied (or the request is for a login page), Salesforce first examines the requested domain. If the requested domain is a My Domain (i.e. of the form https://mycompany.my.salesforce.com/), then we look up the associated org and check whether SAML (or, from Winter '13, an ...


21

My Domain replaces your URL with the MyDomain.my.salesforce.com URL Before Summer'13 there was a problem where the older pre-MyDomain links wouldn't redirect 'properly' to the My Domain links, eg if you clicked on a link you received from Chatter via email, it would ask you to login again even though you were already logged in, because somehow it couldn't ...


18

You're trying to setup / use Service Provider (SP) Initiated SSO. In this case Salesforce is the SP and you've configured an external IdP to provide authentication. SP Initiated Login works on Salesforce with My Domain. Additionally you will need to set up Salesforce for federated authentication on your IdP, by (at least in case of ADFS) importing the ...


7

In the org, go to Setup | Security Controls | Single Sign-On Settings and click the SAML Assertion Validator button. If the SSO attempt got as far as your org, you should see something there that will lead you towards identifying the problem. If there is nothing listed in the SAML Assertion Validator, then Salesforce is not able to identify the correct org ...


7

Looks like you pretty much have covered all the steps an admin can perform to configure salesforce as an Identity provider. He can update the custom attributes to be sent back as part of assertion, but is limited to available dropdown options provided by Salesforce (Mentioned in your question). However, there is a possible way to extend the custom attribute ...


7

I had a read of the documentation, such as Configure SSO Across Multiple Salesforce Orgs which covers the hub-and-spoke architecture from the question. I can't find any reference to "Salesforce SAML JIT Provisioning". The valid options are Standard or Custom SAML JIT with Apex handler - Source In SAML Single Sign-On Settings, select User ...


6

If you look at that response carefully, you'll see that the JavaScript actually makes a request of https://xxx.my.salesforce.com/, not your server. You need to follow one step further to see the request to your server. Here's an abbreviated version of what I just saw. First, the initial OAuth request to a My Domain URL: $ curl -v 'https://superpat-...


6

Solution is to setup SAML SSO and also enable Delegated Authentication. Need to apply the "Enable Single Sign On" permission to those users you want to force to use SAML SSO using either profiles or permission sets. Administrators should be excluded from this process, so that they can always login (even if sso is down). Note : My Domain setup doesn't help ...


6

Yes, you can use Federated Authentication (e.g. SAML) and Delegated Authentication (DA) in parallel. The Mobile CRM product prompts the user for username and password - they give their enterprise password, which is be verified by the DA mechanism - a SOAP message is sent to an endpoint in the enterprise, which validates the username/password. When SAML is ...


6

You can set up another Salesforce org (e.g. a developer edition) to be your IDP - that's how I got to grips with it originally. There's a wiki article that guides you through the whole process at: http://wiki.developerforce.com/page/Implementing_Single_Sign-On_Across_Multiple_Organizations


6

Note that in the current version (Winter 13), the Authentication Service option is now under 'Login Page Branding', and you specify the name of the SAML Setting you configured. See screenshot.


6

You will find the "Is Single Sign-On Enabled" checkbox on the User profile under the System Permissions group. Please note that this permission is related to delegated authentication and not to SAML SSO.


5

If you have My Domain set up (and, if you are configuring SAML, you should!), you can configure Salesforce for Outlook with the domain (e.g. mycompany.my.salesforce.com). As described in the docs, [...] click Change URL and pick the server to which you want to connect. If the server you want isn’t listed, select Other... and enter the URL, such as a ...


5

There are no costs associated with SSO from Salesforce. Any licenses that have unlimited logins have unlimited SSO logins as well. Licenses with limited logins share those limits with normal logins. SAML does impose some additional limitations, so there might be some out of pocket costs. For example, during our implementation, we found we needed a public ...


5

You'll want to take a peek at Single Sign-On for Desktop and Mobile Applications using SAML and OAuth. There are several different directions you could take. The article mentioned here shows how Chatter and Connect for Outlook do SAML-based authentication over OAuth2. In theory, you could skip the OAuth2 part, but that makes controlling the landing a bit ...


5

If I understand your question correctly, this should be the approach you should be following. Force.com sites do support SSO using SAML. You need to provide the following info for your identity provider Organization ID Portal ID Sites URL The following must be added as attributes to the SAML assertion sent from your identity provider:...


5

The process is very much similar to how you set up for Internal Users except that you need to replace with Community URLS . Lets look at step by step the mechanism to accomplish the same .For simplicity I am taking another winter 17 pre release org as a SP (Service Provider) Step 1 Set Up a Partner Community in Salesforce(This is your IDP org) .Not going ...


5

I think the second problem you listed is causing the first problem, and unfortunately it's a bit of a layered answer. I'm also assuming that the MetadataService layer you've generated is all correct. The first part to solve is getting the ConnectedAppOauthConfig.isAdminApproved = true. Now I couldn't get this to set on creation of the Connected App. However,...


4

I think I've had that problem in the past, and it was down to how the assertion was being encoded. I used this online Base64URL encoder to try and match up how the assertion looked after it was Base64URL Encoded. http://kjur.github.io/jsjws/tool_b64uenc.html I would also look at the login history of the User you're trying to login as on Salesforce as that ...


4

Using Salesforce Communities: Edit the Community's Login Page, and ensure that your SAML IdP is the only selected login option: Now users will be automatically directed to the IdP for login, instead of seeing the Salesforce Community login page. For Internal Users You need to create a My Domain (see documentation). My Domain gives your org a custom login ...


4

As I noted in a comment above, if your organization is set up to use SAML as the means of authentication (which requires a MySalesforce URL), then the SDK should redirect authentication to the SAML authentication page in question rather than the OAuth page. This does require your application to reference the MySalesforce URL for authentication rather than ...


4

After some extensive trial and error I finally found the solution for the error: > {"error_description":"user hasn't approved this > consumer","error":"invalid_grant"} For whatever reason, the salesforce SAML/OAuth2 implementation needs to have the "Refresh Token" scope assigned in the Connected App settings. Without it - this error - appeared. In ...


4

I got this figured out. Regarding Ref. 1: https://help.salesforce.com/apex/HTViewSolution?id=000198728&language=en_US The tutorial suggested that we choose "Portal" instead of "Standard" for login option. But this is wrong! (Confirmed by Salesforce Engineer) Instead we need to leave it as "Standard" and pass the attributes specified in the tutorial ...


4

How a mainstream encryption scenario works in SAML: identity provider encrypts some elements of the SAML response with service provider's public key. (I am assuming an asymmetric cipher which is how most implementations incl. Salesforce do this). The service provider decrypts using the private key that corresponds to the public key used to encrypt. In other ...


4

When you edit an existing connected app, there should be a section down the bottom called Custom Attributes. Here you can set custom fields, and a formula for the values of those fields, to be returned in the SAML response. From the documentation: Each custom attribute must have a unique key and must use fields available from the Insert Field menu. For ...


4

Following steps can be followed to enable Salesforce as a Service Provider. Enable My Domain in Salesforce You need to download Certificate from your IDp application. For testing purpose, you can use Axiom application to act as a temporary IDp. Enable SSO in Salesforce Configure SSO in Salesforce by providing various values like shown in below image. These ...


4

oAuth was designed for this use case and SF supports many oAuth flows. If you want to avoid using a service account (aka integration user), then pick a flow where user has to authorize access. From there you're in a standard oAuth refresh + access token management lifecycle, the user doesn't have to be logged in. When you implement oAuth, there are quite a ...


4

From documentation: When defining a service provider, if the Subject Type is Username, the Salesforce organization ID is prepended to the user name in the SAML assertion. For example, if the user is jDeoint@WFC.com, the subject for the SAML assertion contains 00DE0000000FFLT@jDeoint@WFC.com. If the Subject Type is Federation ID, the exact federation ID is ...


3

I know this is old, but I'll add to this. Ditto the sandbox recommendation above Here's a little bit of a gotcha: You can't change the color of the login button, but you kinda dont know that until you've already implemented it. Depending on the colors used in your branding, the 'ol SFDC blue might look great...or might look horrible.


3

There is no password flow between ADFS and Salesforce, its handled using cryptographic assertions of an XML document over SSL. Outlook loads Plugin reaches out to your mycompany.my.salesforce.com (as @metdaddy describes above) Salesforce redirects the plugin to your local ADFS based on the config you set up (note, not identity details have been exchanged ...


Only top voted, non community-wiki answers of a minimum length are eligible