15
votes
Accepted
remove advertising on login page of Salesforce
If you have SSO then I assume you have My Domain enabled.
In the My Domain setup you can set the right frame URL, if it's blank it loads the ad from Salesforce. I would point it to some internal page ...
- 3,478
14
votes
Accepted
Enable SSO for Salesforce Marketing Cloud
We don't have a very helpful documentation on enabling Marketing Cloud SSO. We do have some really useful information on the background of the process but once we start the implementation, there are ...
- 949
10
votes
Accepted
Dynamically adding custom attributes to SAML response
Looks like you pretty much have covered all the steps an admin can perform to configure salesforce as an Identity provider. He can update the custom attributes to be sent back as part of assertion, ...
- 2,419
8
votes
Accepted
How Do You Enable SAML IdP in a Partner Community?
The process is very much similar to how you set up for Internal Users except that you need to replace with Community URLS .
Lets look at step by step the mechanism to accomplish the same .For ...
- 90.4k
8
votes
Accepted
My Org SSO refers me to home page, no deep linking
The most comprehensive documentation is going to be the Single Sign On Implementation Guide.
From your description it sounds like your IdP is not passing the RelayState parameter back through ...
- 22.9k
7
votes
Accepted
What is the difference between 2048 and 4096 key size?
Many services do not support 4096-bit keys. A web search came across So you're making an RSA key for an SSL certificate. What key size do you use?, where the author explains the primary differences ...
- 481k
7
votes
How to authenticate Data Loader with Single Sign On?
The answer saying it does not work is now outdated.
You can use single sign-on with Data Loader since version 36 if you have a custom domain (xyz.my.saleforce.com).
On the log in screen, choose ...
- 1,224
7
votes
Accepted
What is the difference between delegated authentication and single sign-on (SSO)?
With Delegated Authentication, the user logs in through the normal Salesforce login page, but Salesforce checks with a third-party server for the password. In this case, the user literally has no ...
- 481k
6
votes
Accepted
Difference between Authentication and Identity Provider
Short answer is yes. Salesforce can be Authentication Provider and Identity Provider at same time.
The main difference between Authentication Provider and Identity provider is -
Identity Provider :...
- 29.4k
6
votes
Accepted
Single Sign-On for Marketing Cloud
You will manage the roles in MC. Users still need to be created in Marketing Cloud, and have roles and business units assigned. The advantage of SSO is, that they would not need to provide MC ...
- 20.5k
5
votes
Cannot delete Single Sign-on Settings
If you are unable to delete SAML Single Sign-On Settings in Salesforce, check the below before deleting it.
Go to Domain Management --> My Domain. Check whether the SAML Settings is disabled in "...
5
votes
Accepted
Is SAML based login possible with older integrations that use the old SOAP based login?
You'll want to take a peek at Single Sign-On for Desktop and Mobile Applications using SAML and OAuth. There are several different directions you could take. The article mentioned here shows how ...
- 481k
5
votes
Accepted
How to setup Salesforce Identity Provider to work with Twilio Flex
To setup Salesforce Idenity Provider to work with Twilio Flex you need to complete these steps:
Create an self-signed certificate
Enable Salesforce Identity Provider
Create Twilio Flex Connected App
...
- 9,187
5
votes
Salesforce SSO with multiple identity providers
Yes. You can configure multiple Identity Providers in the same Org and let Users choose which IdP to use when they login. There is no restriction to be able to configure multiple IdPs in an Org.
I ...
- 30.3k
4
votes
Salesforce as service provider
Following steps can be followed to enable Salesforce as a Service Provider.
Enable My Domain in Salesforce
You need to download Certificate from your IDp application. For testing purpose, you can ...
- 3,102
4
votes
remove advertising on login page of Salesforce
If you are using chrome, you can make a chrome extension to do this. Firefox and I think Safari also allow you to make extensions.
My extension widens the login inputs, but making the advertising div ...
- 20.3k
4
votes
Accepted
Salesforce SSO appending user id to the user name
Looks like you have Subject Type in your Service Provider's SAML, configured as Username in Salesforce. If that's the case, then what you are experiencing is the expected behavior.
From documentation:
...
- 30.3k
4
votes
Single Sign on in sandbox
The Authentication Service section in My Domain shows up the SSO configurations only if SAML is enabled in your Org and that My Domain is deployed. Refer to the below excerpt from the documentation ...
- 30.3k
4
votes
Accepted
Disable forgot password for SSO Users
You can always have admins login using direct URL even when the Prevent login from ... is enabled. The way to do so is to append a query parameter login in the login URL (example below) where admins ...
- 30.3k
4
votes
Let external system modify Salesforce data on behalf of logged in user
oAuth was designed for this use case and SF supports many oAuth flows. If you want to avoid using a service account (aka integration user), then pick a flow where user has to authorize access. From ...
- 7,261
4
votes
Accepted
Automate setup of an external identity provider via APIs
Taking the summary out of comments for everyone's benefit: the screens you reference are for implementation of a scenario where an external service/app is acting as a SAML identity provider, SF is a ...
- 7,261
4
votes
Authorize Apex Rest API call using an Azure token
In general, for oauth to work, the user needs to authorise salesforce to perform requests on their behalf.
If you haven't done it already, I suggest you go through the documentation on the many ...
- 1,177
4
votes
Accepted
What is "Request Signing Certificate" used for?
As per Salesforce documentation:
Request Signing Certificate: The certificate used to generate the signature on a SAML request to the identity provider. This signing certificate is used when ...
- 4,185
4
votes
Accepted
Redirecting to MyDomain URL
You can create a Site and add a redirect from a Site URL to a destination. The destination can be any relative or absolute URL, including a MyDomain URL.
Out of the box, the hostname of the site ...
- 7,261
4
votes
Accepted
Access by same Community user to Two Communities
Each community represents its own security context. That is, community B doesn't automagically "trust" community A in terms of user logging in even if the same user is a member of both communities. To ...
- 7,261
4
votes
JIT provisioning for Person accounts
The limitation of Person Account with JIT is no more a limitation now. See below screenshot from login & registration page of experience cloud site.
4
votes
Access Restricted for API Only Users
Salesforce owned many similar access control method , included "Profile" , "Permission set" , "Permission set Group" , "Public Group" ...
To escape from "...
- 141
4
votes
Accepted
Will Salesforce passwords still expire during SSO usage?
Yes, passwords expire. If the password is expired, SSO will still work normally. They will not be forced to change their password until they log in with their Salesforce password, as opposed to their ...
- 481k
4
votes
Accepted
Why doesn't SSO between my Digital Experience sites work?
There is a "Select login options to display on the login page" section in the Workspace → Administration → Login & Registration → Login Page Setup that once a "SAML Single Sign-On ...
- 135k
3
votes
remove advertising on login page of Salesforce
It's possible to customize the right side section, see bullet #6 in Customize Your Login Page with Your Brand:
Enter the URL of the file to be included in the right-side iFrame on
the login ...
- 3,094
Only top scored, non community-wiki answers of a minimum length are eligible