Logging in to Salesforce using the Identity Server

This topic provides instructions on how to log into Salesforce using your WSO2 Identity Server credentials.

Configuring Salesforce

Sign up as a Salesforce developer.
1. Fill out the relevant information found in the following URL: https://developer.salesforce.com/signup
2. Click Sign me up.
3. You will receive a security token by email to confirm your new account. If you did not receive the email successfully, you will be able to reset it by following the steps given here.
Log in with your new credentials as a Salesforce developer. Do this by clicking Login link in the top right hand side of https://developer.salesforce.com/.
Click Allow to enable Salesforce to access your basic information.
Once you are logged in, create a new domain and access it. To do this, do the following steps.
1. Go to Domain Management in the left navigation pane and click My Domain.
2. In the page that appears, come up with a name for your domain. You can check if the domain is available by clicking the Check Availability button.
3. Check and agree with the Terms and Conditions before clicking Register Domain to register your new domain.
4. Once the domain is registered to your account, click the Click here to login button to test this out.
On the left navigation menu, go to Security Controls and click Single Sign-On Settings.
In the page that appears, click Edit and then select the SAML Enabled checkbox to enable federated single sign-on using SAML.
Click Save to save this configuration change.
Click New under SAML Single Sign-On Settings. The following screen appears.
Ensure that you configure the following properties.
Click Save to save your configurations.
Go to Domain Management in the left navigation pane and click My Domain.
Click Deploy to Users. Click Ok to the confirmation message that appears.
In the page that appears, you must configure the Authentication Configuration section. Scroll down to this section and click Edit.
Under Authentication Service, select SSO instead of Login Page.
Click Save.

Configuring the Identity Server

Sign in. Enter your username and password to log on to the Management Console.
Navigate to the Main menu to access the Identity menu. Click Add under Service Providers.
Fill in the Service Provider Name and provide a brief Description of the service provider. Only Service Provider Name is a required field and we use Salesforce as the name for this example.
Click Register.
Expand the Inbound Authentication Configuration and the SAML2 Web SSO Configuration and click Configure.
In the form that appears, fill out the following configuration details required for single sign-on.

See the following table for details.
Click Register to save your configurations.
Since Salesforce user names are actually email addresses, we must configure the Identity Server for email authentication. Do the following steps to achieve this.
1. Open the <IS_HOME>/repository/conf/carbon.xml file and make the following change to the configuration.
  <EnableEmailUserName>true</EnableEmailUserName>
2. Open the <IS_HOME>/repository/conf/user-mgt.xml file and add the following properties under the user store manager configurations. Using the first property, you can change the pattern of your email address. By default it must be more than 3 characters and less than 30, but you can configure it as you wish.
  <Property name="UsernameWithEmailJavaScriptRegEx">[a-zA-Z0-9@._-|//]{3,30}$</Property> <Property name="UsernameJavaRegEx">a-zA-Z0-9@._-{3,30}$</Property>
Restart the Identity Server.

Testing the configurations

Do the following steps to test out the configurations for a new user in Salesforce and the Identity Server.

Once you log into the Identity Server, navigate to the Main menu in the Management Console, click Add under Users and Roles.
Click Users. This link is only visible to users with the Admin role.
Click Add New User. When adding a new user, use an email address as the username.
Navigate back to the Main menu in the Management Console and click Add under Users and Roles.
Click Roles. This link is only visible to users with the Admin role.
Click Add New Role.

When adding a new role, do the following.
1. In the Domain list, specify the user store where you want to create this role. In this case, use the default user store that comes with the Identity Server.
2. Enter a unique name for this role. Use Force here for example.
3. Click Next.
Select the permissions you want users with this role to have. Note that when you assign this role to a user, you can override the role's permissions and customize them for the user. For our example, providing login permissions should suffice.
Click Next.
Select the existing users you want to have this role. You can also assign this role to users later, but if you are creating this role in an external user store that does not allow empty roles, you must assign it to at least one user. You can search for a user by name, or view all users by entering * in the search field. In this case, select the user with the username as the email address that you created earlier.
Click Finish.
Log back into your Salesforce developer account.
On the left navigation pane, click Users under Manage Users.
On the page that appears, click the New User button to create a new user.
Create a user with the same username as the one you created in the Identity Server. Click Save to save your changes. An email will be sent to the email address you provided for the user.
Access your Salesforce login URL. For this example, the Salesforce login URL is https://identityprovisioning-dev-ed.my.salesforce.com?so=00D90000000ySEn. You are directed to the Identity Server login screen.
Log in using the new credentials of the user you just created. You are then redirected back to Salesforce.