Logging in to Salesforce with Integrated Windows Authentication

The WSO2 Identity Server supports a wide array of authentication and authorization mechanisms. The application authentication framework of the Identity Server is capable of translating between heterogeneous authentication protocols and transforming and mediating any identity assertion.

Integrated Windows Authentication (IWA) is an authentication mechanism introduced by Microsoft to authenticate users in Microsoft Windows NT-based operating systems. IWA authentication provides an easier way for users to log in to applications that use Windows Active Directory as an userstore. It is a popular choice of authentication among Windows server users and administrators, since it eliminates the need of remembering extra credentials of the users, and reduces the authentication overhead for the server administrators.

This topic provides instructions on how to configure WSO2 Identity Server to authenticate Salesforce users using Integrated Windows Authentication. 

The following sections list out the instructions on how to configure this.

1. Sign up as a Salesforce developer if you don't have an account. If you already have an account, move on to step 2 and log in to Salesforce.

   1. Fill out the relevant information found in the following URL:  https://developer.salesforce.com/signup

   2. Click Sign me up.

   3. You will receive a security token by email to confirm your new account. If you did not receive the email successfully, you will be able to reset it by following the steps given here.

2. Log in with your new credentials as a Salesforce developer. Do this by clicking the Login link in the top right hand side of https://login.salesforce.com/.

3. Click Allow to enable Salesforce to access your basic information.

4. Once you are logged in, create a new domain and access it. 

   To do this, do the following steps.
   

5. On the left navigation menu, search for Single Sign-On Settings, and click it.

6. In the page that appears, click Edit and then select the SAML Enabled checkbox to enable federated single sign-on using SAML.
   
   

   Open

   

7. Click Save to save this configuration change.

8. Click New under SAML Single Sign-On Settings. The following screen appears. 
   

   Ensure that you configure the following properties.

9. Click Save to save your configurations.

10. Go to Domain Management in the left navigation pane and click My Domain.

11. Click Deploy to Users. Click Ok to the confirmation message that appears.

12. In the page that appears, you must configure the Authentication Configuration section. Scroll down to this section and click Edit.

13. Under Authentication Service, select SSO instead of Login Page.
    
    

    Open

    

14. Click Save.

15. Next you need to obtain the Salesforce certificate and upload it to the Identity Server.

    Do the following steps to obtain the certificate.

    1. On the left navigation menu, go to Security Controls and click Certificate and Key Management.

    2. If you have not done so already, you must create the certificate first. Do the following steps to create this.

       1. Click Create Self-Signed Certificate.

       2. Enter the Label and a Unique Name and click Save. The certificate is generated.

    3. Click the Download Certificate button to download the certificate.

1. Sign in. Enter your username and password to log on to the management console. 

2. Navigate to the Main menu to access the Identity menu. Click Add under Service Providers.

3. Fill in the Service Provider Name and provide a brief Description of the service provider. Only Service Provider Name is a required field and we use Salesforce as the name for this example.
   
   

   Open

   

4. Click Register.

5. Expand the Inbound Authentication Configuration and the SAML2 Web SSO Configuration and click Configure.

6. In the form that appears, fill out the following configuration details required for single sign-on.
   

   
    See the following table for details.

7. Click Register to save your configurations.

8. When you log into Salesforce, you normally use an email address. So, to integrate this with the Identity Server, you need to configure WSO2 IS to enable users to log in using their email addresses. 

9. Restart the Identity Server.