15

If you have SSO then I assume you have My Domain enabled. In the My Domain setup you can set the right frame URL, if it's blank it loads the ad from Salesforce. I would point it to some internal page for your users. Or, you can create a force.com site page with any image/value you want and it would be 100% on the platform. Or, I found there are blank ...


11

To successfully implement SSO so that it works with Salesforce1, you must make sure that the server is configured correctly to support the idosyncrocies of Salesforce1, which is more stringent than other clients (e.g. every major web browser on the market). This answer documents some common mistakes and outlines how to correctly configure AD FS. AD FS and ...


11

We don't have a very helpful documentation on enabling Marketing Cloud SSO. We do have some really useful information on the background of the process but once we start the implementation, there are various questions that I did not find much help on. I have successfully implemented SSO for my account and would like to share the practical steps that need to ...


9

Looks like you pretty much have covered all the steps an admin can perform to configure salesforce as an Identity provider. He can update the custom attributes to be sent back as part of assertion, but is limited to available dropdown options provided by Salesforce (Mentioned in your question). However, there is a possible way to extend the custom attribute ...


8

Yes, you can SSO into one or more target Salesforce orgs via OpenID Connect from Google: http://help.salesforce.com/apex/HTViewHelpDoc?id=sso_provider_openid_connect.htm&language=en_US A couple of helpful blogs that walk you through this http://dice.neko-san.net/2014/01/using-google-as-an-open-id-connect-authentication-source-for-salesforce-com/ http:...


8

The most comprehensive documentation is going to be the Single Sign On Implementation Guide. From your description it sounds like your IdP is not passing the RelayState parameter back through correctly during the redirects that happen during the SSO process. This parameter contains the URL that the user initially requested before they were sent to the IdP ...


7

NOTE: All of these answers depend on the OOTB functionality. It is possible to adapt the Data Loader to perform all of these actions by using Java and importing the classes; this isn't an answer that covers that in-depth. There is an OSS version of ADL on GitHub, if you're so inclined. GUI: Does Dataloader GUI work with SAML? No, SAML requires browser ...


6

Note that in the current version (Winter 13), the Authentication Service option is now under 'Login Page Branding', and you specify the name of the SAML Setting you configured. See screenshot.


6

I've created my own login objects, classes, and pages where I keep track of users, and when they log on, I create my own SessionId and store the info in an object + a client side Cookie. Then, I have a method (used in the Action parameter of apex:page) that validates my session for every Portal Site page visited. I too have multiple sites for a single org ...


6

You will find the "Is Single Sign-On Enabled" checkbox on the User profile under the System Permissions group. Please note that this permission is related to delegated authentication and not to SAML SSO.


6

Many services do not support 4096-bit keys. A web search came across So you're making an RSA key for an SSL certificate. What key size do you use?, where the author explains the primary differences between the two. It basically comes down to speed, security, and compatibility. Many platforms are not compatible with 4096-bit keys, using 4096-bit keys will ...


6

The process is very much similar to how you set up for Internal Users except that you need to replace with Community URLS . Lets look at step by step the mechanism to accomplish the same .For simplicity I am taking another winter 17 pre release org as a SP (Service Provider) Step 1 Set Up a Partner Community in Salesforce(This is your IDP org) .Not going ...


5

The data returned in an OpenID Connect request is dependent on the OAuth scope requested when the user logs in. This is configured on the "Default Scopes" field in the Auth. Provider record. For google, this is documented at https://developers.google.com/accounts/docs/OAuth2Login. Based on the scopes selected, Google prompts the user to accept request to ...


5

What it looks like you're attempting to do is login to a community via Salesforce SSO and Auth Providers using credentials from that org, and this is not allowed. Your Salesforce instance that serves as your identity provider must be a different org than the one hosting your community. Attempting to sign in to the community using credentials from the org ...


5

There are no costs associated with SSO from Salesforce. Any licenses that have unlimited logins have unlimited SSO logins as well. Licenses with limited logins share those limits with normal logins. SAML does impose some additional limitations, so there might be some out of pocket costs. For example, during our implementation, we found we needed a public ...


5

You'll want to take a peek at Single Sign-On for Desktop and Mobile Applications using SAML and OAuth. There are several different directions you could take. The article mentioned here shows how Chatter and Connect for Outlook do SAML-based authentication over OAuth2. In theory, you could skip the OAuth2 part, but that makes controlling the landing a bit ...


5

Short answer is yes. Salesforce can be Authentication Provider and Identity Provider at same time. The main difference between Authentication Provider and Identity provider is - Identity Provider : An identity provider is a trusted provider that lets you use single sign-on to access other websites. A service provider is a website that hosts applications. ...


5

You will manage the roles in MC. Users still need to be created in Marketing Cloud, and have roles and business units assigned. The advantage of SSO is, that they would not need to provide MC credentials when logging into MC. You can select which users in SFMC would be applicable for SSO, as you still might have cases where some users (e.g. if you are ...


4

You don't need to change the password because those applications have used OAuth to obtain a token that authorises them. Changing passwords will not effect them, The tokens are perpetual until revoked by the client or on the server by the user or an admin (or Freeze/Deactivate the user). See this article: https://help.salesforce.com/apex/HTViewHelpDoc?id=...


4

http://wiki.developerforce.com/page/How_to_Implement_Single_Sign-On_with_Force.com Refer the above article and thats the one of the best articles i have read on this . You will first need to raise a case with salesforce to enable delegated authentication for your org. https://help.salesforce.com/apex/HTViewHelpDoc?id=sso_delauthentication_configuring.htm&...


4

Canvas apps are sent an authentication token automatically after being authorized by the user; this all occurs on the salesforce.com servers, and your app isn't involved until it receives a valid authentication token. You can query for the user ID if you need to store per-user data; the ID is guaranteed to be unique, while the email address may not be. The ...


4

Although you can configure an Auth. Provider without a RegistrationHandler, according to Salesforce H&T, it is not optional if you need to sign in: A registration handler class is required to use Authentication Providers for the single sign-on flow. When you configure an Auth. Provider without a registration handler, Salesforce then makes the Single ...


4

Using Salesforce Communities: Edit the Community's Login Page, and ensure that your SAML IdP is the only selected login option: Now users will be automatically directed to the IdP for login, instead of seeing the Salesforce Community login page. For Internal Users You need to create a My Domain (see documentation). My Domain gives your org a custom login ...


4

The RelayState parameter is defined here The important thing to note is that it has now been changed as mentioned When a service provider initiates login, the default RelayState is now /. In previous releases, the default RelayState was /home/home.jsp. It is required that your IDP echoes this back correctly Ensure your IdP is properly receiving the ...


4

I got this figured out. Regarding Ref. 1: https://help.salesforce.com/apex/HTViewSolution?id=000198728&language=en_US The tutorial suggested that we choose "Portal" instead of "Standard" for login option. But this is wrong! (Confirmed by Salesforce Engineer) Instead we need to leave it as "Standard" and pass the attributes specified in the tutorial ...


4

How a mainstream encryption scenario works in SAML: identity provider encrypts some elements of the SAML response with service provider's public key. (I am assuming an asymmetric cipher which is how most implementations incl. Salesforce do this). The service provider decrypts using the private key that corresponds to the public key used to encrypt. In other ...


4

When you edit an existing connected app, there should be a section down the bottom called Custom Attributes. Here you can set custom fields, and a formula for the values of those fields, to be returned in the SAML response. From the documentation: Each custom attribute must have a unique key and must use fields available from the Insert Field menu. For ...


4

The answer saying it does not work is now outdated. You can use single sign-on with Data Loader since version 36 if you have a custom domain (xyz.my.saleforce.com). On the log in screen, choose OAuth, select the environment, press the Log in button, then click on the "Use custom domain" link, enter your custom domain, and you will be forwarded to your ...


4

Following steps can be followed to enable Salesforce as a Service Provider. Enable My Domain in Salesforce You need to download Certificate from your IDp application. For testing purpose, you can use Axiom application to act as a temporary IDp. Enable SSO in Salesforce Configure SSO in Salesforce by providing various values like shown in below image. These ...


4

If you are using chrome, you can make a chrome extension to do this. Firefox and I think Safari also allow you to make extensions. My extension widens the login inputs, but making the advertising div invisible should be pretty easy also. Make a manifest: { "manifest_version": 1, "name": "Modify CSS and HTML", "version": "0.1.0", "description": "...


Only top voted, non community-wiki answers of a minimum length are eligible