19

My Domain replaces your URL with the MyDomain.my.salesforce.com URL Before Summer'13 there was a problem where the older pre-MyDomain links wouldn't redirect 'properly' to the My Domain links, eg if you clicked on a link you received from Chatter via email, it would ask you to login again even though you were already logged in, because somehow it couldn't ...


18

When an HTTP request arrives at Salesforce, if there is no valid session ID supplied (or the request is for a login page), Salesforce first examines the requested domain. If the requested domain is a My Domain (i.e. of the form https://mycompany.my.salesforce.com/), then we look up the associated org and check whether SAML (or, from Winter '13, an ...


17

You're trying to setup / use Service Provider (SP) Initiated SSO. In this case Salesforce is the SP and you've configured an external IdP to provide authentication. SP Initiated Login works on Salesforce with My Domain. Additionally you will need to set up Salesforce for federated authentication on your IdP, by (at least in case of ADFS) importing the ...


15

If you have SSO then I assume you have My Domain enabled. In the My Domain setup you can set the right frame URL, if it's blank it loads the ad from Salesforce. I would point it to some internal page for your users. Or, you can create a force.com site page with any image/value you want and it would be 100% on the platform. Or, I found there are blank ...


12

You can use it with a portal (see step 11 in the documentation). The user's Facebook ID is associated with their Salesforce user record. You receive their name and email in the registration handler when they SSO in. The registration handler can use the incoming Auth.UserData to query for a match on an existing user and either create a new user or return an ...


9

To successfully implement SSO so that it works with Salesforce1, you must make sure that the server is configured correctly to support the idosyncrocies of Salesforce1, which is more stringent than other clients (e.g. every major web browser on the market). This answer documents some common mistakes and outlines how to correctly configure AD FS. AD FS and ...


8

Yes, you can SSO into one or more target Salesforce orgs via OpenID Connect from Google: http://help.salesforce.com/apex/HTViewHelpDoc?id=sso_provider_openid_connect.htm&language=en_US A couple of helpful blogs that walk you through this http://dice.neko-san.net/2014/01/using-google-as-an-open-id-connect-authentication-source-for-salesforce-com/ http:...


8

The most comprehensive documentation is going to be the Single Sign On Implementation Guide. From your description it sounds like your IdP is not passing the RelayState parameter back through correctly during the redirects that happen during the SSO process. This parameter contains the URL that the user initially requested before they were sent to the IdP ...


7

We use Salesforce as an Identity Provider for SSO into our Customer Portal. We use a Sites domain to isolate the sessions - so that users' own org sessions are not clobbered by logging in to our portal. I have written up what we did here: http://foobarforce.com/2012/12/07/salesforce-identity-provider-for-portal/ There may be enough overlap with what you ...


7

NOTE: All of these answers depend on the OOTB functionality. It is possible to adapt the Data Loader to perform all of these actions by using Java and importing the classes; this isn't an answer that covers that in-depth. There is an OSS version of ADL on GitHub, if you're so inclined. GUI: Does Dataloader GUI work with SAML? No, SAML requires browser ...


6

You can set up another Salesforce org (e.g. a developer edition) to be your IDP - that's how I got to grips with it originally. There's a wiki article that guides you through the whole process at: http://wiki.developerforce.com/page/Implementing_Single_Sign-On_Across_Multiple_Organizations


6

You can use both SAML SSO and normal SF username/password authentication at the same time, enabling SSO does not disable the usual authentication. If you want to disable normal username/password login I believe you have to setup delegated authentication for a profile and point it's authentication url at a non existant url or one that always returns no. ...


6

In the org, go to Setup | Security Controls | Single Sign-On Settings and click the SAML Assertion Validator button. If the SSO attempt got as far as your org, you should see something there that will lead you towards identifying the problem. If there is nothing listed in the SAML Assertion Validator, then Salesforce is not able to identify the correct org ...


6

Solution is to setup SAML SSO and also enable Delegated Authentication. Need to apply the "Enable Single Sign On" permission to those users you want to force to use SAML SSO using either profiles or permission sets. Administrators should be excluded from this process, so that they can always login (even if sso is down). Note : My Domain setup doesn't help ...


6

Yes, you can use Federated Authentication (e.g. SAML) and Delegated Authentication (DA) in parallel. The Mobile CRM product prompts the user for username and password - they give their enterprise password, which is be verified by the DA mechanism - a SOAP message is sent to an endpoint in the enterprise, which validates the username/password. When SAML is ...


6

Note that in the current version (Winter 13), the Authentication Service option is now under 'Login Page Branding', and you specify the name of the SAML Setting you configured. See screenshot.


6

I've created my own login objects, classes, and pages where I keep track of users, and when they log on, I create my own SessionId and store the info in an object + a client side Cookie. Then, I have a method (used in the Action parameter of apex:page) that validates my session for every Portal Site page visited. I too have multiple sites for a single org ...


6

Many services do not support 4096-bit keys. A web search came across So you're making an RSA key for an SSL certificate. What key size do you use?, where the author explains the primary differences between the two. It basically comes down to speed, security, and compatibility. Many platforms are not compatible with 4096-bit keys, using 4096-bit keys will ...


5

If you have My Domain set up (and, if you are configuring SAML, you should!), you can configure Salesforce for Outlook with the domain (e.g. mycompany.my.salesforce.com). As described in the docs, [...] click Change URL and pick the server to which you want to connect. If the server you want isn’t listed, select Other... and enter the URL, such as a ...


5

If you look at that response carefully, you'll see that the JavaScript actually makes a request of https://xxx.my.salesforce.com/, not your server. You need to follow one step further to see the request to your server. Here's an abbreviated version of what I just saw. First, the initial OAuth request to a My Domain URL: $ curl -v 'https://superpat-...


5

The data returned in an OpenID Connect request is dependent on the OAuth scope requested when the user logs in. This is configured on the "Default Scopes" field in the Auth. Provider record. For google, this is documented at https://developers.google.com/accounts/docs/OAuth2Login. Based on the scopes selected, Google prompts the user to accept request to ...


5

What it looks like you're attempting to do is login to a community via Salesforce SSO and Auth Providers using credentials from that org, and this is not allowed. Your Salesforce instance that serves as your identity provider must be a different org than the one hosting your community. Attempting to sign in to the community using credentials from the org ...


5

There are no costs associated with SSO from Salesforce. Any licenses that have unlimited logins have unlimited SSO logins as well. Licenses with limited logins share those limits with normal logins. SAML does impose some additional limitations, so there might be some out of pocket costs. For example, during our implementation, we found we needed a public ...


5

You'll want to take a peek at Single Sign-On for Desktop and Mobile Applications using SAML and OAuth. There are several different directions you could take. The article mentioned here shows how Chatter and Connect for Outlook do SAML-based authentication over OAuth2. In theory, you could skip the OAuth2 part, but that makes controlling the landing a bit ...


5

The process is very much similar to how you set up for Internal Users except that you need to replace with Community URLS . Lets look at step by step the mechanism to accomplish the same .For simplicity I am taking another winter 17 pre release org as a SP (Service Provider) Step 1 Set Up a Partner Community in Salesforce(This is your IDP org) .Not going ...


5

Looks like you pretty much have covered all the steps an admin can perform to configure salesforce as an Identity provider. He can update the custom attributes to be sent back as part of assertion, but is limited to available dropdown options provided by Salesforce (Mentioned in your question). However, there is a possible way to extend the custom attribute ...


4

You cannot "hook in a trigger" to the Salesforce user session lifecycle events because you don't have access to them directly. You probably don't need to, and correct me if I am wrong here, but aren't you allowing the user to be authenticated by the front end platform to the bd database(via webservice) and to salesforce(via SSO). You can use this ...


4

You don't need to change the password because those applications have used OAuth to obtain a token that authorises them. Changing passwords will not effect them, The tokens are perpetual until revoked by the client or on the server by the user or an admin (or Freeze/Deactivate the user). See this article: https://help.salesforce.com/apex/HTViewHelpDoc?id=...


4

Canvas apps are sent an authentication token automatically after being authorized by the user; this all occurs on the salesforce.com servers, and your app isn't involved until it receives a valid authentication token. You can query for the user ID if you need to store per-user data; the ID is guaranteed to be unique, while the email address may not be. The ...


4

Although you can configure an Auth. Provider without a RegistrationHandler, according to Salesforce H&T, it is not optional if you need to sign in: A registration handler class is required to use Authentication Providers for the single sign-on flow. When you configure an Auth. Provider without a registration handler, Salesforce then makes the Single ...


Only top voted, non community-wiki answers of a minimum length are eligible