This documentation is for WSO2 Identity Server 5.3.0 . View documentation for the latest release.

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. Sign up as a Salesforce developer if you don't have an account. If you already have an account, move on to step 2 and log in to Salesforce.
    1. Fill out the relevant information found in the following URL:  https://developer.salesforce.com/signup
    2. Click Sign me up.
    3. You will receive a security token by email to confirm your new account. If you did not receive the email successfully, you will be able to reset it by following the steps given here.
  2. Log in with your new credentials as a Salesforce developer. Do this by clicking the Login link in the top right hand side of https://login.salesforce.com/.

    Note
    titleNote!

    This document is explained using the Salesforce lightning theme. If you are using the classic theme, follow the steps given below to switch to the lightning theme:

    Expand
    titleClick here to find the steps on how to switch from the classic to the lightning theme.
    1. Click your username to expand the drop down.
    2. Click Switch to Lightning Experience.
    3. Click the settingS settings icon on the top-right-hand corner, and click Set Up.

    Now you are navigated to the lightening theme of Salesforce.

  3. Click Allow to enable Salesforce to access your basic information.
  4. Once you are logged in, create a new domain and access it. 

    Tip

    Tip: This step is required only if the validation request is sent by the service provider. For identity provider initiated validation requests, this is not required.

    To do this, do the following steps.

    Excerpt Include
    Logging in to Salesforce with Facebook
    Logging in to Salesforce with Facebook
    nopaneltrue

  5. On the left navigation menu, search for Single Sign-On Settings, and click it.
  6. In the page that appears, click Edit and then select the SAML Enabled checkbox to enable federated single sign-on using SAML.
  7. Click Save to save this configuration change.
  8. Click New under SAML Single Sign-On Settings. The following screen appears. 
    Ensure that you configure the following properties.

    FieldValue
    NameSSO
    API NameSSO
    Issuer

    localhost

    Note

    Note: In this case we have localhost as the Issuer as this topic is a sample of how this should work. In a production environment where you need to run this scenario, you must have the domain name or host name of the server that you are hosting the WSO2 Identity Server.

    Entity Idhttp://saml.salesforce.com
    Identity Provider Certificate

    wso2.crt

    Note

    Note: To create the Identity Provider Certificate, open your Command Line interface, traverse to the <IS_HOME>/repository/resources/security/ directory. Next you must execute the following command.

    Code Block
    keytool -export -alias wso2carbon -file wso2.crt -keystore wso2carbon.jks -storepass wso2carbon

    Once this command is run, the wso2.crt file is generated and can be found in the <IS_HOME>/repository/resources/security/ directory. Click Choose File and navigate to this location in order to obtain and upload this file.

    Request Signing CertificateFrom the dropdown, you must select the public certificate of Salesforce. If you have not created this already, check step 15 of this section for details on how to create the certificate.
    Request Signature MethodRSA-SHA1
    Assertion Decryption CertificateAssertion not encrypted
    SAML Identity Type

    Assertion contains User's salesforce.com username

    SAML Identity Location

    Identity is in the NameIdentifier element of the Subject statement

    Identity Provider Login URL

    https://localhost:9443/samlsso

    Note

    Note: In this case we have localhost as the URL as this topic is a sample of how this should work. In a production environment where you need to run this scenario, you must have the domain name or host name of the server that you are hosting the WSO2 Identity Server.

    Identity Provider Logout URL

    https://localhost:9443/samlsso

    Note

    Note: In this case we have localhost as the URL as this topic is a sample of how this should work. In a production environment where you need to run this scenario, you must have the domain name or host name of the server that you are hosting the WSO2 Identity Server.

    Custom Error URLLeave blank

    Service Provider Initiated Request Binding

    HTTP POST
    User Provisioning EnabledLeave blank
  9. Click Save to save your configurations.
  10. Go to Domain Management in the left navigation pane and click My Domain.
  11. Click Deploy to Users. Click Ok to the confirmation message that appears.
  12. In the page that appears, you must configure the Authentication Configuration section. Scroll down to this section and click Edit.
  13. Under Authentication Service, select SSO instead of Login Page.
  14. Click Save.
  15. Next you need to obtain the Salesforce certificate and upload it to the Identity Server.

    Info
    titleAbout the Salesforce certificate

    The validation request sent from Salesforce must be validated by the Identity Server. For this purpose, the Salesforce public certificate must be uploaded to the Identity Server and is used to validate the request.

    Do the following steps to obtain the certificate.

    1. On the left navigation menu, go to Security Controls and click Certificate and Key Management.
    2. If you have not done so already, you must create the certificate first. Do the following steps to create this.
      1. Click Create Self-Signed Certificate.
      2. Enter the Label and a Unique Name and click Save. The certificate is generated.
    3. Click the Download Certificate button to download the certificate.

...