Enabling SAML based Single Sign On (SSO) in Salesforce

Today I continue my little experiment to enable Single Sign On (SSO) on one of my Salesforce Orgs using SAML.

For this research, I previously setup another one of my Salesforce developer orgs as my Identity Provider. The steps to follow while setting up an Idp in Salesforce are captured in my previous post - Setting up Salesforce as an Identity Provider.

As a first step, you may need information from your Idp to help setup SSO. Things you will need to know are -

• SAML version (1.1 or 2.0)
• Entity Id (or Issuer) of the Idp
• A certificate that will be used to authenticate the requests
• SAML assertion parameters such as SAML User id type

It may be easier to do this setup by obtaining the SAML metadata xml from the Identity Provider.
In my case as the Idp is another Salesforce org, I can use the Download Metadata button to download the xml required from the Setup -> Security Controls -> Identity Providers screen.

There will be steps the Identity Provider will have to do to enable this communication as well. I will cover the steps I need to do in my Salesforce Idp environment as well in this post.

Below are steps to enable Single Sign On in Salesforce -

• Navigate to Setup -> Security Controls -> Single Sign On Settings screen.
• Click Edit and select the checkbox "SAML Enabled".

• Next you can click New button in the SAML Single Sign On Settings section and come to below screen. Here you can fill in the SAML settings manually.

    Here you can set the details you gathered from the Idp like the Entity Id, Issuer, the certificate from the Idp, SAML Identity Type, SAML Identity Location, Idp's login and logout urls.

You could rather avoid doing this manually by importing the metadata xml provided by the Idp. I am going to do that myself using the xml I obtained from my Salesforce Idp environment.

• So instead of above step, I am going to click the New from Metadata button and choose the file provided by the Idp. This will fill in details in the above screen for you. If you are also using Salesforce as your Idp, you will something on these lines - 
• Issuer - It will be set to the my domain name of your Idp Org. If you are not using Salesforce as the Idp, the Issuer will be set to value provided by your Idp.
• Entity id - It will be set to the my domain name of your Org. (this will be used at the Idp. In our scenario, it will be set in the Connected Apps section in the Idp Salesforce Org).
• identity location - it will be set to NameIdentifier element
• identity type - it will be set to Federation id. This is important. I will explain this in a step below.
• service provider initiated request binding - HTTP Redirect
• Idp login url - it will be set to the Idp endpoint url
• Idp Certificate - Certificate provided by the Idp
• Request Signing Certificate - choose a certificate from Certificates & key management screen list. I am going to go with the Default Certificate setting as this is only research.
• Request Signing method - choose the mechanism to be used for encryption.
• I am not setting up Just in time provisioning. I will leave that to my Salesforce administrator for now.
• In the above settings, identity location and identity type are set to Subject and Federation Id as I am using Salesforce as my Idp. However based on the Idp you are using, these values may differ. You will need to work with your Idp to select the correct values. Federation Id field value on the user record should match the value sent by the Idp saml subject.
• Once you save the settings, you will see the Salesforce Login URL on the page. This is also referred to as ACS url. Note this down as it will be useful later when you setup this environment as a connected app in your salesforce Idp org.
• Now that you have setup SSO in the environment, you need to link these settings to the My Domain of the org. Only then will it know that it has to use these SSO settings.
• Navigate to Setup -> Domain Management -> My Domain. For your My Domain, edit the Authentication Configuration and set the Authentication Service to this SSO setting. Disable the Login Page option from under your My Domain.

If you are using an Idp who has already configured all settings required for enabling SSO for you, you are done! You should be able to access your my domain url and see the Idp's login page or get logged in without a prompt (if you were previously logged in to the Idp on the browser).

In my case, I need to do one more step to enable this connectivity. That is to enable this above org as a connected app in the Idp Salesforce Org. I am adding the steps for doing that in the next blog post.