Single Sign-On gives users a single set of credentials to access multiple applications. Users will spend less time managing passwords.
Okta can be used as an Identity provider and Salesforce will be the service provider for users.
In the scope of this project, Salesforce will be the service provider that will use a 3rd-party to authenticate access to it.
[Current understanding is that the identity provider will be Microsoft Azure Active Directory.
Microsoft provides a tutorial on how to configure this (Tutorial: Azure Active Directory single sign-on (SSO) integration with Salesforce | Microsoft Docs) ]
Create a free developer account for Okta at https://developer.okta.com/signup/ .
Goto “Browse App Catalog”
Select “Salesforce.com”
Click “Add Integration”
On the next screen in “General Settings” tab
Goto Salesforce org > Setup > My Domain. Copy the domain name from there and paste it back in Okta setting (show above).
Click “Next” button.
On “Sign-on options” tab select “SAML 2.0”
Go back to Salesforce org > Setup > Single Sign-on settings and enable SAML if not already enabled.
Once you click “Save” , options to create a new record will show. Click “New”.
On “New” Single Sign-on screen settings, put the settings as below. In a new browser tab open Okta (if not already opened) and goto single sign-on settings tab (step 8 on this document), scroll down and click the “View Setup Instructions“ button.
In this page you will find the information to feed to the single sign-on settings page for your Salesforce org. Go back to the Salesforce org page and enter the following information:
Name: Enter a name of your choice.
SAML Version: Make sure this is set to 2.0. This should be enabled by default.
Issuer: [Copy and paste from the page] (this is unique to everyone)
Identity Provider Certificate: Download, then upload the following certificate into this field:
[From instructions manual]
Identity Provider Login URL: Copy and paste the following: [From instructions manual]
This URL will authenticate your users when they attempt to log in directly to Salesforce or click on a deep link in Salesforce and are not currently authenticated. This is required if you want to enable SP-Initiated SAML authentication.
Custom Logout URL: Optional. Copy and paste the following:
[From instructions manual]
API Name: Enter an API name of your choice.
Entity ID:
If you have a custom domain setup, use https://[customDomain].my.salesforce.com
Note: If you have configured a sandbox environment, don't include .sandbox in the custom domain field.
If you do not have a custom domain setup, use https://saml.salesforce.com
Notes: If you are configuring this on a sandbox, the entity id should be your production URL i.e. "https://mydomain.my.salesforce.com"" and not "https://mydomain--mysandbox.sandbox.my.salesforce.com""
On the Okta side the domain should be "mydomain" and not "mydomain--mysandbox" or "mydomain--mysandbox.sandbox" as indicated by the help text there.
Click Save.
Your final screen should look something similar to the following
12. Now, go back to okta settings and provide the login URL from the Salesforce Single sign-on screen and paste to okta settings and press “Done”.
Connected app creation
Create a new “Connected App” in Salesforce by going to Setup > App Manager > “New Connected App”
2. Enter the app name, api name should generate automatically.
3. Then enter the contact email, could be helpdesk or support email (Salesforce uses this contact information if they need to contact you about the connected app.).
4. In the API (Enable OAuth Settings) section, enter the “Callback URL” as
Select the following OAuth scopes:
Manage User data via APIs (api)
Perform requests at any time (refresh token, offline access)
Leave the other setting as-is and “Save”.
5. In OKTA, goto Salesforce app → Provisioning → Integration and then click on “Configure API Integration” button.
6. Click “Enable API Integration” checkbox
7. Enter the OAuth Consumer Key and OAuth Consumer Secret from Connected App
8. Click on “Authenticate with Salesforce.com” and if successful then press “Save” button at the bottom.
9. Go back to the Okta app and User provisioning tab.
From Okta → Salesforce flow, select “Create Users” and “Deactivate Users”. Optionally select “Update User Attributes”.
Click Save.
6. For Salesforce to be the service-provider (SP-initiated flow), go to Salesforce → Setup → My Domain and scroll to the “Authentication Configuration” section and select the single sign-on setting we created earlier.
7. Click “Save” and Done!
Notes:
To enable the permission for SSO on profile level go to Setup → Single Sign-on Settings → and check the “Disable login with Salesforce credentials” option.
Disable direct logins through http://login.salesforce.com or https://test.salesforce.com
In Setup, in the Quick Find box, enter Company Settings, then select My Domain.
In the Policies section, click Edit.
Set the Login Policy by selecting Prevent login from https://login.salesforce.com , then save your changes.
Enabling Step 2 will disable login from Salesforce URL for every user, if it is required to disable it for specific profiles or allow admins to continue to use the Salesforce URL in case of third-party outage then don’t enable option 2.
3. Enable SSO at the profile level.
From Setup, in the Quick Find box, enter Profiles, then select Profiles.
Edit the desired profile, then find the Administrative Permissions section.
Select Is Single Sign-On Enabled, then save your change.
No comments:
Post a Comment