Outbound Provisioning with Salesforce

The WSO2 Identity Server (WSO2 IS) has the ability to provision users into different domains like Salesforce, Google, Facebook, etc., using its identity provisioning framework.

This topic provides instructions on how to configure Salesforce as the Identity Provider to provision users from WSO2 Identity Server. The service provider in this scenario is WSO2 Identity Server. When WSO2 IS is the service provider, it is configured as the resident Service Provider. Therefore, after completing this tutorial you can see the users you add using WSO2 Identity Server being created in Salesforce too.

Configuring Salesforce

1. Sign up as a Salesforce developer.

   1. Fill out the relevant information found in the following URL: https://developer.salesforce.com/signup
      

   2. Click Sign me up.

   3. You will receive a security token by email to confirm your new account. If you did not receive the email, you can reset it by following the steps given here.

2. Log in with your new credentials as a Salesforce developer: https://login.salesforce.com/

3. Click Allow to enable Salesforce to access your basic information. This message pops up only when you log in to Salesforce for the first time.

4. Once you are logged in, add a connected app. Follow instructions below on how to do this. Click here for a more information.

   1. Expand Apps and click App Manager. 
      

   2. In the window that appears, click New Connected Apps that is on the top right corner.

   3. Fill in the form that appears with relevant details.
      The following table describes the form labels in detail.

      Open

      

   4. Click Save > Continue to add the connected app.

5. The resulting screen displays key information that you will need to configure the Identity Server to Salesforce. 
   Make a note of the following details as you need them in upcoming configurations. 

   1. Consumer Key

   2. Consumer Secret (Click the Click to reveal link to view the consumer secret)

   3. Callback URL

   Open

   

6. Add your connected app to the profile you are going to use. This is necessary as this profile is used when you add users in to Salesforce from the Identity Server. 

   1. Expand Users and click Profiles. A list of existing profiles can be viewed.
      

   2. As an example, if you use the profile “Chatter Free User”, click Edit and select the connected app you created to configure with the Identity Server using the provided checkbox.
      Example:
      

   3. Click Save. Make a note of the profile ID (or address URL) of the Chatter Free User profile.

7. Get the public certificate for Salesforce. Do the following in order to achieve this. 

   1. In the left navigation pane, Expand Security and click Certificate and Key Management or you can search for Certificate and Key Management in the Quick Find search box.
      

   2. Click Create Self-Signed Certificate.

   3. Enter the Label and a Unique Name and click Save. The certificate is generated.
      

   4. Click the Download Certificate button to download the certificate.

[Back to the top]

Configuring the Identity Server to use email address as the username

Provisioning is the process of coordinating the creation of user accounts, e-mail authorizations in the form of rules and roles, and other tasks such as provisioning of resources associated with enabling new users.

1. Download the WSO2 Identity Server from here and run it.

2. Log in to the Management Console as an administrator.

3. When you log into Salesforce, you normally use an email address. So, to integrate this with the Identity Server, you need to configure WSO2 IS to enable users to log in using their email addresses. In order to do that, follow the steps found in the Using Email Address as the Username topic.

4. Restart the Identity Server.

Now that you are done with configuring the email address for use in authentication, configure the identity provider and the service provider.

[Back to the top]

Configuring Salesforce as the Identity Provider

This section includes steps on how to register Salesforce as an Identity Provider.

1. Start the WSO2 Identity Server if it is not started up already and log in using the email you configured in the realm as instructed above in step 3 of Configuring the Identity Server. 

2. On the Management Console, click on Add under Identity Providers.

3. In the form that appears, provide a name for your identity provider by filling in the Identity Provider Name. You can use "Salesforce.com" as an example, but this can be any name you choose. See Configuring an Identity Provider for information on registering and configuring an identity provider.

4. Upload the Salesforce public certificate that you generated and saved in step 7 under Configuring Salesforce.
   Do this by clicking the Choose File button next to Identity Provider Public Certificate.

   Open

   

5. Expand the Claim Configuration section of the form, followed by the Basic Claim Configuration section, and select Define Custom Claim Dialect. 

6. Click Add Claim Mapping and add the following claims.
   Local claims in WSO2 IS are unique URIs. These are mapped to the attributes required by salesforce to create a new profile. Therefore, in this step you are mapping the attributes required by Salesforce to a unique URI. Now, when creating a new profile/user WSO2 IS sends these values to the correct attribute of Salesforce.

   Open

   

7. Expand the Advanced Claim Configuration section.

8. Select the Claim URI you added from the Provisioning Claim Filter dropdown and click Add Claim.
   

9. For each Claim URI, enter a default value as shown in the following table. The default values are used when creating the role in Salesforce.
   For example, the alias, email, profile ID and all the values listed below are shown when a user is created.
   These are sample values to help you understand better about claim URI and its value types.

   Open

   

10. Expand the Outbound Provisioning Connectors section followed by the Salesforce Provisioning Configuration section.

11. Do the following configurations for Salesforce provisioning. For more information on any of these fields, see Configuring Salesforce provisioning.

    1. Select Enable Connector to enable the Salesforce connector.

    2. Enter the API version. This is the version of the API you are using in Salesforce. 
       Follow the steps given below to get the API version:

       1. To obtain this, log into https://login.salesforce.com. 

       2. Search for API in the Quick Find search box and click API. 

       3. Generate any one of the WSDL's to check the version. You are navigated to page with XML syntaxes.

       4. On the top it will mention as "Salesforce.com Enterprise Web Services API Version <VERSION>".  For example: Salesforce.com Enterprise Web Services API Version 41.0

       5. Enter this value for the API version in the following format: v<VERSION_NUMBER>. For example: v41.0.

    3. Enter the Domain. If you do not have a Salesforce domain, you need to create a domain by logging into https://login.salesforce.com. 

    4. Enter the Client ID. This is the Consumer Key obtained in step 5 when configuring Salesforce.

    5. Enter the Client Secret. This is the Consumer Secret obtained in step 5 when configuring Salesforce.

    6. Enter the Username. This is the Salesforce username.

    7. Enter the Password. This is the Salesforce password and must be entered along with the security token. So you would enter this in the following format: <password><security_token>
       For example, if your password is testpassword and your security token is 37f37f4433123, the value you would enter here is testpassword37f37f4433123.

12. Click Register.