Page Comparison

...

1. Sign up as a Salesforce developer if you don't have an account. If you already have an account, move on to step 2 and log in to Salesforce.
   1. Fill out the relevant information found in the following URL:  https://developer.salesforce.com/signup
   2. Click Sign me up.
   3. You will receive a security token by email to confirm your new account. If you did not receive the email successfully, you will be able to reset it by following the steps given here.

2. Log in with your new credentials as a Salesforce developer. Do this by clicking the Login link in the top right hand side of https://login.salesforce.com/.

3. Click Allow to enable Salesforce to access your basic information.

4. Once you are logged in, create a new domain and access it. 

   To do this, do the following steps.

   Excerpt

   Search for My Domain in the search bar that is on the left navigation panel. Image Removed Click My Domain. In the page that appears, come up with a name for your domain. You can check if the domain is available by clicking the Check Availability button. Info For the page given below to load on your browser, make sure that the Salesforce cookies are not blocked. Image Removed If the domain is available, select I agree to Terms and Conditions and click Register Domain to register your new domain. Tip Tip: The registration process may take some time. Use this time to get familiar with Salesforce and read through the Salesforce developer documentation. Once the domain is registered to your account, click the Click here to login button to test this out.

5. On the left navigation menu, search for Single Sign-On Settings, and click it.
6. In the page that appears, click Edit and then select the SAML Enabled check box to enable federated single sign-on using SAML.
   Image Removed
7. Click Save to save this configuration change.
8. AnchorSalesforce-CertificateSalesforce-CertificateObtain the Salesforce certificate and upload it to the Identity Server. Follow the steps given below to obtain the certificate.

   Info
   title About the Salesforce certificate
   The validation request sent from Salesforce must be validated by the Identity Server. For this purpose, the Salesforce public certificate must be uploaded to the Identity Server and is used to validate the request.

   1. On the left navigation menu, go to Security Controls and click Certificate and Key Management.
   2. If you have not done so already, you must create the certificate first. Do the following steps to create this.
      1. Click Create Self-Signed Certificate.
      2. Enter the Label and a Unique Name, and click Save. The certificate is generated.
   3. Click the Download Certificate button to download the certificate.
   AnchorSAML-SSO-SettingsSAML-SSO-SettingsClick New under SAML Single Sign-On Settings. The following screen appears. 
   Image Removed
   Ensure that you configure the following properties.

   Tip
   If you want to know more about the Salesforce SAML Single Sign-On settings configurations, see the Salesforce developer documentation.

   FieldValueNameSSOAPI NameSSOIssuer

   localhost

   Note
   Note: In this case we have localhost as the Issuer as this topic is a sample of how this should work. In a production environment where you need to run this scenario, you must have the domain name or host name of the server that you are hosting the WSO2 Identity Server.

   Entity Id AnchorEntity-IDEntity-ID https://saml.salesforce.comIdentity Provider Certificate

   Generate the wso2.crt file and upload it. Follow the steps given in the note below:

   Note
   title Creating the Identity Provider certificate.
   Note: To create the Identity Provider Certificate, open your Command Line interface, traverse to the <IS_HOME>/repository/resources/security/ directory. Next you must execute the following command. Code Block keytool -export -alias wso2carbon -file wso2.crt -keystore wso2carbon.jks -storepass wso2carbon Once this command is run, the wso2.crt file is generated and can be found in the <IS_HOME>/repository/resources/security/ directory. Click Choose File and navigate to this location in order to obtain and upload this file.

   Request Signing CertificateFrom the dropdown, you must select the public certificate of Salesforce you created in step 8.
   If you have not created this already, follow the steps given in step 8 above. After creating the certificate, you need start filling the SAML Single

   Note
   title Note!
   This document is explained using the Salesforce lightning theme. If you are using the classic theme, follow the steps given below to switch to the lightning theme: Expand title Click here to find the steps on how to switch from the classic to the lightning theme. Click your username to expand the drop down. Click Switch to Lightning Experience. Image Added Click the settings icon on the top-right-hand corner, and click Set Up. Image Added Now you are navigated to the lightening theme of Salesforce.

9. Click Allow to enable Salesforce to access your basic information.

10. Once you are logged in, create a new domain and access it. 

    To do this, do the following steps.

    Excerpt

    Search for My Domain in the search bar that is on the left navigation panel. Image Added Click My Domain. In the page that appears, come up with a name for your domain. You can check if the domain is available by clicking the Check Availability button. Info For the page given below to load on your browser, make sure that the Salesforce cookies are not blocked. Image Added If the domain is available, select I agree to Terms and Conditions and click Register Domain to register your new domain. Once the domain is registered to your account, click the Click here to login button to test this out.

11. On the left navigation menu, search for Single Sign-On Settings, and click it.
12. In the page that appears, click Edit and then select the SAML Enabled check box to enable federated single sign-on using SAML.
    Image Added
13. Click Save to save this configuration change.

14. Anchor
    Salesforce-Certificate Salesforce-Certificate

    Obtain the Salesforce certificate. You need to upload it to the Identity Server later on. Follow the steps given below to obtain the certificate.

    Info
    title About the Salesforce certificate
    The validation request sent from Salesforce must be validated by the Identity Server. For this purpose, the Salesforce public certificate must be uploaded to the Identity Server and is used to validate the request.

    1. On the left navigation menu, go to Security Controls and click Certificate and Key Management.
    2. If you have not done so already, you must create the certificate first. Do the following steps to create this.
       1. Click Create Self-Signed Certificate.
       2. Enter the Label and a Unique Name, and click Save. The certificate is generated.
    3. Click the Download Certificate button to download the certificate.

15. Anchor
    SAML-SSO-Settings SAML-SSO-Settings

    Click New under SAML Single Sign-On Settings. The following screen appears. 
    Image AddedEnsure that you configure the following properties.

    Tip
    If you want to know more about the Salesforce SAML Single Sign-On settings configurations, see the Salesforce developer documentation.

    Field	Value
    Name	SSO
    API Name	SSO
    Issuer	localhost Note Note: In this case we have localhost as the Issuer as this topic is a sample of how this should work. In a production environment where you need to run this scenario, you must have the domain name or host name of the server that you are hosting the WSO2 Identity Server.
    Entity Id	Anchor Entity-ID Entity-ID https://saml.salesforce.com
    Identity Provider Certificate	Generate the wso2.crt file and upload it. Follow the steps given in the note below: Note title Creating the Identity Provider certificate. Note: To create the Identity Provider Certificate, open your Command Line interface, traverse to the <IS_HOME>/repository/resources/security/ directory. Next you must execute the following command. Code Block keytool -export -alias wso2carbon -file wso2.crt -keystore wso2carbon.jks -storepass wso2carbon Once this command is run, the wso2.crt file is generated and can be found in the <IS_HOME>/repository/resources/security/ directory. Click Choose File and navigate to this location in order to obtain and upload this file.
    Request Signing Certificate	From the dropdown, you must select the public certificate of Salesforce you created in step 8. If you have not created this already, follow the steps given in step 8 above. After creating the certificate, you need start filling the SAML Single Sign-On Setting form from beginning again.
    Request Signature Method	RSA-SHA1
    Assertion Decryption Certificate	Assertion not encrypted
    SAML Identity Type	Assertion contains User's salesforce.com username
    SAML Identity Location	Identity is in the NameIdentifier element of the Subject statement
    Service Provider Initiated Request Binding	HTTP POST
    Identity Provider Login URL	https://localhost:9443/samlsso Note Note: In this case we have localhost as the URL as this topic is a sample of how this should work. In a production environment where you need to run this scenario, you must have the domain name or host name of the server that you are hosting the WSO2 Identity Server.
    Custom Logout URL	Leave blank
    Custom Error URL	Leave blank
    Single Logout Enabled	Optionally, if you want to have single log out enabled, you can select this option. With Single Log Out, you can log out of FB and be logged out of Salesforce at the same time.
    User Provisioning Enabled	Leave blank Info If you want to enable Just In Time provisioning, you need to select this configuration. When this configuration is enabled, WSO2 Identity Server creates a user in Salesforce, if the user doesn't have an FB account and signs up with Facebook. Therefore, you don't have to worry about creating a user in salesforce everytime a new user needs to be added.

16. Click Save to save your configurations.
17. Search for My Domain in the search bar that is on the left navigation pane and click My Domain.
18. Go to Domain Management in the left navigation pane and click My Domain.
    
19. Click Deploy to Users. Click Ok to the confirmation message that appears.
20. In the page that appears, you must configure the Authentication Configuration section. Scroll down to this section and click Edit.
    

21. Under Authentication Service, select SSO and deselect Login Page.
    

    Info
    SSO is the SAML user authentication method you created in salesforce.com, in step 9 above. It is configured to direct users to WSO2 Identity server, which in turn direct the request to Facebook as Facebook acts as the IdP.

22. Click Save.

...

1. Sign in. Enter your username and password to log on to the management console. 
2. Navigate to the Main menu to access the Identity menu. Click Add under Service Providers.
3. Fill in the Service Provider Name and provide a brief Description of the service provider. Only Service Provider Name is a required field and we use Salesforce as the name for this example.
   
4. Click Register.
5. Expand the Inbound Authentication Configuration and the SAML2 Web SSO Configuration and click Configure.

In the form that appears, fill out the following configuration details required for single sign-on.
See the following table for details.

Insert excerptLogging in to Salesforce using the Identity ServerLogging in to Salesforce using the Identity Servernopaneltrue
6. Click Register to save your configurations.

7. Since Salesforce user names are actual email addresses, we must configure the Identity Server for email authentication. Do the following steps to achieve this.

   1. Open the <IS_HOME>/repository/conf/carbon.xml file and comment out the EnableEmailUserName property.

      Code Block
      language xml
      <EnableEmailUserName>true</EnableEmailUserName>

   2. Open the <IS_HOME>/repository/conf/user-mgt.xml file and add the following property under the user store manager configurations. Using above property, you can change the pattern of your email address. By default, it must be more than 3 characters and less than 30, but you can configure it as you wish.

      Code Block
      language xml
      <Property name="UsernameWithEmailJavaScriptRegEx">^[\S]{3,30}$</Property>

8. Restart the Identity Server. 

Configuring the Facebook application

...

Configuring the identity provider

Now you have to configure WSO2 Identity Server by adding Facebook as a new identity provider.

...

Give a suitable name as the Identity Provider Name. In this case we can have Facebook as the identity provider name for clarity.

...

Go to Facebook Configuration under Federated Authenticators. 

...

Select both check-boxes to Enable Facebook Authenticator and make it the Default.

Enter the App ID and App Secret values from the Facebook app you created in the Client ID and Client Secret fields respectively.

...

...

...

Image Removed

...

You have now added the identity provider.

Configuring the federated authenticator for the service provider

The next step is to configure the federated authenticator for the service provider. In this case, the service provider is Salesforce

1. Return to the management console.
2. In Configuring claim mapping for Salesforce:
   1. In the Identity section under the Main tab, click List under Service Providers.
   2. Click Edit to edit the Salesforce service provider you created. 
   3. Expand the Claim Configuration section.
   4. Select the Define Custom Claim Dialect option under Select Claim mapping Dialect.

   5. Click Add Claim URI to add custom claim mappings as follows.
      Add the following claim URIs.

      Service Provider Claim	Local Claim
      email	http://wso2.org/claims/emailaddress
      first_name	http://wso2.org/claims/givenname
      last_name	http://wso2.org/claims/lastname

   6. Select all of these claims as Requested Claims.

   7. Anchor
      subject-claim-id subject-claim-id

      Select email from the Subject Claim URI dropdown. The Subject Claim URI is important to define as it is the unique value used to identify the user. In cases where you have a user store connected to the Identity Server, this Subject Claim URI value is used to search for the user in the user store.
      Image Added
      For more information about claim mapping, see Claim Management.
   8. Click Update to save your changes.
3. Expand the Inbound Authentication Configuration and the SAML2 Web SSO Configuration and click Configure.

4. In the form that appears, fill out the following configuration details required for single sign-on.
   See the following table for details.

   Insert excerpt
   Logging in to Salesforce using the Identity Server Logging in to Salesforce using the Identity Server nopanel true

5. Click Register to save your configurations.

6. When you log into Salesforce, you normally use an email address. So, to integrate this with the Identity Server, you need to configure WSO2 IS to enable users to log in using their email addresses. 

   Panel
   borderColor #EC8B4C bgColor #ffffff borderWidth 1
   Expand title Click here to get the steps on how configure the email address as the username. Include Page Using Email Address as the Username Using Email Address as the Username

7. Restart the Identity Server. 

Configuring the Facebook application

Configuring the identity provider

Now you have to configure WSO2 Identity Server by adding Facebook as a new identity provider.

1. Log in to the management console as an administrator.
2. In the Identity section under the Main tab of the management console, click Add under Identity Providers.

3. Give a suitable name as the Identity Provider Name. In this case we can have Facebook as the identity provider name for clarity.

   Info
   For detailed information on the Identity Provider configurations, see Adding and Configuring an Identity Provider.

4. Choose the salesforce certificate you downloaded in step8 under Configuring Salesforce for Identity Provider Public Certificate.

5. Configuring claim mapping for Facebook:

   1. In the Identity section under the Main tab, click List under 
   Service

Configuring claim mapping for Salesforce

1. In the Identity section under the Main tab, click List under Service Providers.
2. Click Edit to edit the Salesforce service provider you created. 
3. Expand the Claim Configuration section.
4. Select the Define Custom Claim Dialect option under Select Claim mapping Dialect.

Click Add Claim URI to add custom claim mappings as follows.
Add the following claim URIs.

Service Provider ClaimLocal Claimemail http://wso2.org/claims/emailaddress first_name http://wso2.org/claims/givenname last_name http://wso2.org/claims/lastname
5. Select all of these claims as Requested Claims.
6. Anchorsubject-claim-idsubject-claim-idSelect email from the Subject Claim URI dropdown. The Subject Claim URI is important to define as it is the unique value used to identify the user. In cases where you have a user store connected to the Identity Server, this Subject Claim URI value is used to search for the user in the user store.
   Image Removed
   For more information about claim mapping, see Claim Management.Click Update to save your changes
   1. Identity Providers.
7. Go to the service provider that you created and click Edit.

8. Go to Local and Outbound Authentication Configuration section.

9. Select the Identity Provider you created from the dropdown list under Federated Authentication. 

10. Ensure that the Federated Authentication radio button is selected and select Facebook from the dropdown. This is the name of the identity provider that you configured.

    Image Removed

11. Click  Update  to save the changes.

You have now added the identity provider as the federated authenticator for Salesforce.

Configuring claim mapping for Facebook

The next step is to configure claims in the Identity Server and map them with Facebook.

...

Click Add Claim Mapping to add custom claim mappings as follows.
Image Removed

Do the following mappings as shown in the above image.

...

You can retrieve all the public information of the user and the email address. The following are some common attribute names.

More information is available from the following link: https://developers.facebook.com/docs/facebook-login/permissions/v2.0. You can map these attributes to any Local Claim URI that is suitable.
For more information about claim mapping, see Claim Management.

1. 1. Click Edit to edit the Facebook identity provider you created. 
   2. Under Claim Configuration, go to Basic Claim Configuration.
   3. Select the Define Custom Claim Dialect option under Select Claim mapping Dialect. 

   4. Click Add Claim Mapping to add custom claim mappings as follows.
      Image Added

      Do the following mappings as shown in the above image.

      Identity Provider Claim URI	Local Claim URI	Description
      email	http://wso2.org/claims/emailaddress	Here we map the value in Facebook with the claim URI in the Identity Server. In this case it is a direct correlation of claims where the email attribute of Facebook users is mapped to the email attribute used in the Identity Server.
      first_name	http://wso2.org/claims/givenname	Here we map the value in Facebook with the claim URI in the Identity Server. In this case it is a direct correlation of claims where the first_name attribute of Facebook users is mapped to the givenname attribute used in the Identity Server.
      last_name	http://wso2.org/claims/lastname	Here we map the value in Facebook with the claim URI in the Identity Server. In this case it is a direct correlation of claims where the last_name attribute of Facebook users is mapped to the lastname attribute used in the Identity Server.

      Note

      The User ID Claim is important to define as it is the unique value used to identify the user. In cases where you have a user store connected to the Identity Server, this User ID Claim value is used to search for the user in the user store. You can define it when configuring the claims for the identity provider or when configuring the claims for the service provider. In this use case this is configured for the service provider by configuring the Subject Claim URI. If WSO2 Identity server sends roles instead of users and if you want to use those roles to be JIT provisioned to the users of the local userstore, you need to configure Role Claim URI . This configuration is not required for this tutorial.

      You can retrieve all the public information of the user and the email address. The following are some common attribute names.

      Panel
      id email name first_name last_name link gender locale age_range

      More information is available from the following link: https://developers.facebook.com/docs/facebook-login/permissions/v2.0. You can map these attributes to any Local Claim URI that is suitable.
      For more information about claim mapping, see Claim Management.

2. Go to Facebook Configuration under Federated Authenticators. 

3. Select both check-boxes to Enable Facebook Authenticator and make it the Default.

4. Enter the App ID and App Secret values from the Facebook app you created in the Client ID and Client Secret fields respectively.

   Info
   Navigate to the Facebook developer console and click on your app that is under the My App drop down.

   Field	Description	Sample Value
   Client Id	This refers to the App ID you received from the Facebook app you created.	<Application ID of the Facebook App> Image Added
   Client Secret	This refers to the App Secret you received from the Facebook app you created.	<App Secret of the Facebook App>
   Scope	Defines the permission to access particular information from a Facebook profile. See the Permissions Reference for a list of the different permission groups in Facebook APIs.	email
   User Information Fields	These are the claims related to the user account on Facebook. WSO2 Identity Server requests these fields from Facebook when a user is authenticated with Facebook through the IS. See  public_profile permission  for more information about these fields.	id,email,first_name,last_name,
   Callback Url	This is the URL to which the browser should be redirected after the authentication is successful. It should have this format: https://(host-name):(port)/acs.	https://localhost:9443/commonauth

   Image Added

5. Click Register. 

You have now added the identity provider.

Configuring the federated authenticator for the service provider

The next step is to configure the federated authenticator for the service provider. In this case, the service provider is Salesforce

1. Return to the management console.
2. In the Identity section under the Main tab, click List under Service Providers.
3. Go to the service provider that you created and click Edit.

4. Go to Local and Outbound Authentication Configuration section.

5. Select the Identity Provider you created from the dropdown list under Federated Authentication. 

6. Ensure that the Federated Authentication radio button is selected and select Facebook from the dropdown. This is the name of the identity provider that you configured.

   Image Added

7. Click  Update  to save the changes.

You have now added the identity provider as the federated authenticator for Salesforce.

Testing the configurations

...