Skip to main content
10 votes
Accepted

Dynamically adding custom attributes to SAML response

Looks like you pretty much have covered all the steps an admin can perform to configure salesforce as an Identity provider. He can update the custom attributes to be sent back as part of assertion, ...
Salesforcesmarty's user avatar
8 votes
Accepted

How Do You Enable SAML IdP in a Partner Community?

The process is very much similar to how you set up for Internal Users except that you need to replace with Community URLS . Lets look at step by step the mechanism to accomplish the same .For ...
Mohith Shrivastava's user avatar
8 votes
Accepted

What is the reasoning for using Custom SAML JIT Provisioning here?

I had a read of the documentation, such as Configure SSO Across Multiple Salesforce Orgs which covers the hub-and-spoke architecture from the question. I can't find any reference to "Salesforce SAML ...
Daniel Ballinger's user avatar
7 votes
Accepted

Okta SAML SSO error: Unable to map the subject to a Salesforce user

First principles If your SFDC Single Signon configuration SAML Identity type is Federation Id, then the configured Federation Id in Okta has to match the SFDC user with that Federation Id If your ...
cropredy's user avatar
  • 71.9k
6 votes

Metadata API Apex fails to create fields in Connected App

I think the second problem you listed is causing the first problem, and unfortunately it's a bit of a layered answer. I'm also assuming that the MetadataService layer you've generated is all correct. ...
Clint's user avatar
  • 1,101
5 votes

Cannot delete Single Sign-on Settings

If you are unable to delete SAML Single Sign-On Settings in Salesforce, check the below before deleting it. Go to Domain Management --> My Domain. Check whether the SAML Settings is disabled in "...
Sahil Chaudhary's user avatar
5 votes

Using SAML to authenticate user for a force.com site

If I understand your question correctly, this should be the approach you should be following. Force.com sites do support SSO using SAML. You need to provide the following info for your identity ...
Gaurav Kheterpal's user avatar
5 votes
Accepted

"Unable to resolve request into a Service Provider" return by Salesforce Identity Provider for SAML 2.0 request

This usually has to do with the Entity ID field being incorrect in the Service Provider's Single Sign-On Configuration. Make sure it's the Service Provider's domain URL, not the Identity Provider's ...
ceiroa's user avatar
  • 1,029
4 votes

Let external system modify Salesforce data on behalf of logged in user

oAuth was designed for this use case and SF supports many oAuth flows. If you want to avoid using a service account (aka integration user), then pick a flow where user has to authorize access. From ...
identigral's user avatar
  • 7,661
4 votes
Accepted

Automate setup of an external identity provider via APIs

Taking the summary out of comments for everyone's benefit: the screens you reference are for implementation of a scenario where an external service/app is acting as a SAML identity provider, SF is a ...
identigral's user avatar
  • 7,661
4 votes

JIT provisioning for Person accounts

The limitation of Person Account with JIT is no more a limitation now. See below screenshot from login & registration page of experience cloud site.
Kamlesh Kumar's user avatar
4 votes
Accepted

Issuer vs Entity Id

Entity ID: unique URL that identifies your identity provider as the recipient of SAML requests that Salesforce sends. This entity ID must be the same as the <saml:Issuer> attribute in the SAML ...
arut's user avatar
  • 5,301
4 votes

Integration between Salesforce and other systems using existing SAML

If you want to use SAML connection to call Salesforce web services from the SAML assertion take a peek into the SAML Assertion Flow for Accessing the Web Services API The SAML Assertion flows allow ...
Mohith Shrivastava's user avatar
4 votes
Accepted

Why doesn't SSO between my Digital Experience sites work?

There is a "Select login options to display on the login page" section in the Workspace → Administration → Login & Registration → Login Page Setup that once a "SAML Single Sign-On ...
Keith C's user avatar
  • 136k
3 votes
Accepted

Enabling SAML SSO: where is the "Use Single Sign-On" permission?

I'm happy to say that this feature is now fully accessible to administrators. It has been possible to prevent users from using their Salesforce credentials when they were SSO-enabled but it required ...
David Brossard's user avatar
3 votes

How can I get free or trial ExactTarget instance

Developer Editions of Marketing Cloud are no longer available. However, I was told by the team that provided the Developer Edition program that developer account are still available by request. You ...
Eliot Harper's user avatar
  • 16.6k
3 votes
Accepted

SAML SSO Just In Time Provisioning failing with no error information?

Even though Salesforce doesn't display it clearly here, there is additional error information available that can help you figure this out. It's contained in the url of the login request when it fails. ...
Brad Parks's user avatar
3 votes
Accepted

Does Salesforce communities support OAuth 2.0 SAML bearer assertion flow

Following the summer 16 release it does. Setup a connceted app Use the clientID that is generated in the app as the Issuer in the SAML assertion set the Recipient: $PORTAL URL$/services/oauth2/token ...
user36088's user avatar
3 votes
Accepted

Integrate third party app with Salesforce ensuring a seamless experience

The following assumptions made by you are correct and are also validated by the link you quoted. In an SSO scenario I'm supposing that the Salesforce will be the IdP for all client's systems. The ...
Gaurav Kheterpal's user avatar
3 votes
Accepted

Why can't I update a Community Users ProfileID during JIT provisioning via SAML SSO?

After going another route and trying to create my own custom JIT handler, I came across a section in the template JIT code that says you can't update certain fields on the User when also attempting to ...
SirLoyn's user avatar
  • 71
3 votes

All SSO's got affected by changing Self Signed Certificate. What do I need to share with Vendors?

okay, this is rather old post, I would share what I know so far. In SSO, we have 2 certificates to select: One: Identity Provider Certificate. As name suggests, it is the certificate issued by your ...
Wayne Ni's user avatar
  • 609
3 votes

Deflate XML for custom SAML integration?

You can find Visualforce code that implements a JavaScript deflate algorithm online as part of the PlantUML integration here: https://github.com/rsoesemann/plantuml4force It may be a round-about ...
snugsfbay's user avatar
  • 966
3 votes
Accepted

SSO: Enable Multiple Configs - considerations

Based on the details I was able to gather from the comments, here's a bit of explanation on this. Your org is configured prior to Summer '13 and that's the reason you are getting that button. For ...
Jayant Das's user avatar
  • 30.6k
3 votes

Exchange SAML Assertion for an access token

All that means is that your Identity Provider is responsible for generating the SAML Response (also called the SAML assertion). To use the SAML or SAML Bearer Oauth flows you must have an external ...
Greg Grinberg's user avatar
3 votes

Why would SSO stop working : malformed_certificate

This happened to me and here's what I did: Like in your update, I went to Security -> Authentication -> SSO With SAML Applications and found an expired certificate. I clicked the "Add ...
Ryan Shillington's user avatar
3 votes
Accepted

Populating a Federation ID when implementing SSO

If we use Federation ID to be the unique identifier for SSO how will we populate the Federation ID field in Salesforce ? You have a number of options available to you. For example, you could write an ...
sfdcfox's user avatar
  • 495k
2 votes

Cannot delete Single Sign-on Settings

this is a known issue with no fix: https://success.salesforce.com/issues_view?id=a1p30000000sY1bAAE
Perico's user avatar
  • 21
2 votes

Fail to login to community with SAML JIT - 401 Unauthorized

We had this happen to us recently and the solution was as follows: The SAML attribute Account.Owner value referenced a deactivated User ! <Attribute Name="Account.Owner" NameFormat="urn:oasis:...
cropredy's user avatar
  • 71.9k
2 votes

Google SAML Error

The issue is because from the google auth provider your audience value is mismatched . The value is required and must match the Entity ID from the single sign-on configuration. Recheck your ...
Mohith Shrivastava's user avatar
2 votes
Accepted

Who is the createdBy User when SAML JIT creates Contact - Account - User in Communities

Knowing these values can aid in constructing work flows to alert your Community Management folks. For example: when an Account is created that could potentially be a variant spelling of an existing ...
cropredy's user avatar
  • 71.9k

Only top scored, non community-wiki answers of a minimum length are eligible