This guide describes detailed steps for configuring SAML 2.0 federated single sign-on using predefined connector between IBM Cloud Identity and Salesforce. It is assumed that organization already has active Salesforce domain, users are already available in this salesforce domain and are actively using it. Refer Salesforce help for instructions to configure custom domain for your community.

This article primarily focuses on how to setup federated single sign-on between IBM Cloud Identity and Salesforce.

For this federation configuration,

• IBM Cloud Identity acts as Identity Provider (IDP).
• Salesforce acts as Service Provider (SP).

Following are the high level steps for configuring SSO between IBM Cloud Identity and Salesforce:

• Configure IBM Cloud Identity as Identity Provider
• Create a salesforce connector using IBM Cloud Identity dashboard.
• Testing SSO
  • Create user in IBM Cloud Identity with same name as Salesforce username if it does not exist.
  • Test IDP and SP initiated SSO.

Configuration of IBM Cloud Identity as Identity Provider

Following are steps to create salesforce connector using IBM Cloud Identity dashboard:

Log in to your IBM Cloud Identity Connect tenant with admin user.

To start the configuration, navigate to Admin Dashboard.

Go to the Applications tab and click Add applications

Provide name of the Connector. For example: Salesforce

Provide following details in the General tab:

• Domain Name: Provide your organization custom domain for salesforce.

For Example:

If login URL for your salesforce organization is https://<mydomain>.my.salesforce.com, enter “mydomain”.

• Select applications to connect: Select the salesforce applications which is to be displayed on the Launchpad.

If none of the applications are selected, salesforce base application is displayed on Launchpad.

Go to the Single Sign-on tab and provide following details:

• Provider ID: Value for this field will be auto-populated.
• Assertion Consumer Service URL: Provide the Assertion Consumer Service URL for Salesforce.

It should be in the following format:

https://<Salesforce Domain>.my.salesforce.com?so=<Salesforce Organization ID>

To get the value of ‘Salesforce Organization ID”, log in to your salesforce account using admin user and navigate to Company Settings > Company Information. Note down the organization ID listed in “Salesforce.com Organization ID” field.

In the Entitlements tab and specify the access type –

• Automatic access for all users and groups – By default all users and groups get access to this application.
• Approval required for all users and groups – User manager and/or application owner need to approve access for users and groups to access this application.
• Select users and groups and assign individual access - Select specific users and groups to access this application.

I am selecting Automatic access option so that every user and group from my tenant gets access to Salesforce application.

Click Save to save your changes.

On the right side, you can see the instructions to perform configuration at Salesforce.

Configuration of Salesforce as Service Provider

1. Login in salesforce account using https://login.salesforce.com/
2. Navigate to SETTINGS > Company Settings > My Domain
3. Create a new domain.
4. Deploy domain to all users.

Now you can use your domain URL to login to your salesforce account.

e.g. https://<domain-name>.my.salesforce.com

1.1      Configure SAML SSO for Salesforce

1. Log into the Salesforce organization that acts as the service provider.
2. Select
3. Navigate to Identity > Single Sign-On Settings.
4. Select SAML Enabled
5. Click New to setup SAML based login service.

6. Provide the Identity Provider details as following:

7. Provide the Identity Provider details as following:

8. After saving SSO settings note down Salesforce Login URL in the Endpoints This is the Salesforce Assertion Consumer URL.

9. Download salesforce metadata by selecting Download Metadata. This metadata generally is a way to verify Salesforce’s SAML properties like provider ID, ACS URL, etc.

10. To configure the Salesforce login page for single sign-on, perform the following tasks:
    1. If you are using Salesforce Classic UI, navigate to Setup > Domain Management > My Domain > Authentication Configuration.
       If you are using Salesforce Lightning Experience UI, navigate to Setup > Settings > Company Settings > My Domain > Authentication Configuration.
    2. Click Edit.
    3. For the Authentication Service field, select the check box that corresponds to the SAML SSO settings name specified earlier in step 5.
       

1. Click Save to save your changes.

SSO Testing

Prerequisites

Cloud Identity user matching with Salesforce username needs to be present in IBM Cloud Identity. If not, create it using dashboard as follows:

• Login to dashboard with admin credentials.
• Navigate to Users and Groups.
• Click Add
• Enter exact details of the user and click Save.

IDP initiated SSO:

• Log in to the IBM Cloud Identity Launchpad with end user’s credentials.
• User should see the Salesforce

• Click on the Salesforce User will be logged into the salesforce account.