Versions Compared

Old Version 50

changes.mady.by.user Former user

Saved on

compared with

New Version Current

changes.mady.by.user Former user

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. Sign up as a Salesforce developer if you don't have an account. If you already have an account, move on to step 2 and log in to Salesforce.
    1. Fill out the relevant information found in the following URL:  https://developer.salesforce.com/signup
    2. Click Sign me up.
    3. You will receive a security token by email to confirm your new account. If you did not receive the email successfully, you will be able to reset it by following the steps given here.

  2. Log in with your new credentials as a Salesforce developer. Do this by clicking the Login link in the top right hand side of https://login.salesforce.com/.

    Note
    titleNote!

    This document is explained using the Salesforce lightning theme. If you are using the classic theme, follow the steps given below to switch to the lightning theme:

    Expand
    titleClick here to find the steps on how to switch from the classic to the lightning theme.
    1. Click your username to expand the drop down.
    2. Click Switch to Lightning Experience.
      Image Added
    3. Click the settings icon on the top-right-hand corner, and click Set Up.
      Image Added

    Now you are navigated to the lightening theme of Salesforce.

  3. Click Allow to enable Salesforce to access your basic information.

  4. Once you are logged in, create a new domain and access it. 

    To do this, do the following steps.

    Excerpt
    1. Search for My Domain in the search bar that is on the left navigation panel.
    2. Click My Domain.

    3. In the page that appears, come up with a name for your domain. You can check if the domain is available by clicking the Check Availability button.

      Info

      For the page given below to load on your browser, make sure that the Salesforce cookies are not blocked.

    4. If the domain is available, select I agree to Terms and Conditions and click Register Domain to register your new domain.

    5. Once the domain is registered to your account, click the Click here to login button to test this out.
  5. On the left navigation menu, search for Single Sign-On Settings, and click it.
  6. In the page that appears, click Edit and then select the SAML Enabled check box to enable federated single sign-on using SAML.
  7. Click Save to save this configuration change.

  8. Anchor
    Salesforce-Certificate
    Salesforce-Certificate
    Obtain the Salesforce certificate. You need to upload it to the Identity Server later on. Follow the steps given below to obtain the certificate.

    Info
    titleAbout the Salesforce certificate

    The validation request sent from Salesforce must be validated by the Identity Server. For this purpose, the Salesforce public certificate must be uploaded to the Identity Server and is used to validate the request.

    1. On the left navigation menu, go to Security Controls and click Certificate and Key Management.
    2. If you have not done so already, you must create the certificate first. Do the following steps to create this.
      1. Click Create Self-Signed Certificate.
      2. Enter the Label and a Unique Name, and click Save. The certificate is generated.
    3. Click the Download Certificate button to download the certificate.

  9. Anchor
    SAML-SSO-Settings
    SAML-SSO-Settings
    Click New under SAML Single Sign-On Settings. The following screen appears. 
    Ensure that you configure the following properties.

    Tip

    If you want to know more about the Salesforce SAML Single Sign-On settings configurations, see the Salesforce developer documentation.

    FieldValue
    NameSSO
    API NameSSO
    Issuer

    localhost

    Note

    Note: In this case we have localhost as the Issuer as this topic is a sample of how this should work. In a production environment where you need to run this scenario, you must have the domain name or host name of the server that you are hosting the WSO2 Identity Server.

    Entity Id

    Anchor
    Entity-ID
    Entity-ID
    https://saml.salesforce.com

    Identity Provider Certificate

    Generate the wso2.crt file and upload it. Follow the steps given in the note below:

    Note
    titleCreating the Identity Provider certificate.

    Note: To create the Identity Provider Certificate, open your Command Line interface, traverse to the <IS_HOME>/repository/resources/security/ directory. Next you must execute the following command.

    Code Block
    keytool -export -alias wso2carbon -file wso2.crt -keystore wso2carbon.jks -storepass wso2carbon

    Once this command is run, the wso2.crt file is generated and can be found in the <IS_HOME>/repository/resources/security/ directory. Click Choose File and navigate to this location in order to obtain and upload this file.

    Request Signing Certificate

    From the dropdown, you must select the public certificate of Salesforce you created in step 8.

    If you have not created this already, follow the steps given in step 8 above. After creating the certificate, you need start filling the SAML Single Sign-On Setting form from beginning again.

    Request Signature MethodRSA-SHA1
    Assertion Decryption CertificateAssertion not encrypted
    SAML Identity Type

    Assertion contains User's salesforce.com username

    SAML Identity Location

    Identity is in the NameIdentifier element of the Subject statement

    Service Provider Initiated Request Binding

    		HTTP POST
    Identity Provider Login URL

    https://localhost:9443/samlsso

    Note

    Note: In this case we have localhost as the URL as this topic is a sample of how this should work. In a production environment where you need to run this scenario, you must have the domain name or host name of the server that you are hosting the WSO2 Identity Server.

    Custom Logout URL

    Leave blank


    Custom Error URLLeave blank

    Single Logout Enabled

    		Optionally, if you want to have single log out enabled, you can select this option. With Single Log Out, you can log out of FB and be logged out of Salesforce at the same time.
    User Provisioning Enabled

    Leave blank

    Info

    If you want to enable Just In Time provisioning, you need to select this configuration. When this configuration is enabled, WSO2 Identity Server creates a user in Salesforce, if the user doesn't have an FB account and signs up with Facebook. Therefore, you don't have to worry about creating a user in salesforce everytime a new user needs to be added.

  10. Click Save to save your configurations.
  11. Search for My Domain in the search bar that is on the left navigation pane and click My Domain.
  12. Go to Domain Management in the left navigation pane and click My Domain.
  13. Click Deploy to Users. Click Ok to the confirmation message that appears.
  14. In the page that appears, you must configure the Authentication Configuration section. Scroll down to this section and click Edit.

  15. Under Authentication Service, select SSO and deselect Login Page.

    Info

    SSO is the SAML user authentication method you created in salesforce.com, in step 9 above. It is configured to direct users to WSO2 Identity server, which in turn direct the request to Facebook as Facebook acts as the IdP.

  16. Click Save.

...