Steps to configure SAML SSO for Salesforce

Steps to configure OAuth/OpenID Connect-based SSO for Salesforce

The following steps will help you enable OAuth/OpenID Connect-based single sign-on (SSO) for Salesforce from ManageEngine Identity360.

Prerequisites

1. The MFA and SSO license for Identity360 is required to enable SSO for enterprise applications. For more information, refer to pricing details.
2. Log in to Identity360 as an Admin or Super Admin.
3. Navigate to Applications > Application Integration > Create New Application, and select Salesforce from the applications displayed.
   Note: You can also find Salesforce from the search bar located at the top.
4. Under the General Settings tab, enter the Application Name and Description.
5. Under the Choose Capabilities tab, choose SSO and click Continue.
   General Settings of SSO configuration for Salesforce
6. Under Integration Settings, navigate to the Single Sign On tab, select OAuth/OpenID Connect from the Method radio button. Click IdP Details and copy the highlighted field values in the screenshot below.
   Integration Settings of SSO configuration for Salesforce

Salesforce (service provider) configuration steps

1. Login to Salesforce using admin's credentials and navigate to Setup.
   Salesforce portal view
2. Search for Auth.Providers in the search box.
   Search for Salesforce authentication providers
3. Click New to add a new provider.
4. Select the Provider Type as Open ID Connect.
   Addition of authentication provider in Salesforce
5. Enter the Name and URL Suffix as Identity360.
6. Fill the following fields with the corresponding details copied in step 6 of the prerequisites from the Identity360 portal.
   • Consumer Key: Client ID
   • Consumer Secret: Client Secret
   • Authorization Endpoint URL: Authorization Endpoint URL
   • Token Endpoint URL: Token Endpoint URL
   • User Info Endpoint URL: User Endpoint URL
   • Token Issuer: Issuer
7. Click Automatically create a registration handler template link under the Registration Handler field.
   Note: Registration handler is a code snippet that matches service provider attributes with the corresponding identity provider attributes.
8. Under the Execute Registration As field, add the Salesforce admin account.
9. Click Save.
   OAuth SSO configuration in Salesforce
10. After saving, copy the Callback URL, which will be used later in Identity360 configuration.
    Callback URL taken from Salesforce
11. Click the link provided for Registration Handler.
    Auto creation of registration handler in Salesforce
12. Edit the Class Body tab and replace the existing code with the code given in below the screenshot.

                        global class Identity360OIDCHandler implements Auth.RegistrationHandler{ global User createUser(Id portalId, Auth.UserData data){ //The user is authorized, so create their Salesforce user User u = new User(); String username = data.email; List<User> userList = [Select Id, Name, Email, UserName From User Where ( UserName =: username) AND isActive = true ]; if(userList != null && userList.size() > 0) { u = userList.get(0); } return u; } global void updateUser(Id userId, Id portalId, Auth.UserData data){ User u = new User(id=userId); update(u); } }                         

    Code snippet replacement in the Class Body tab of Salesforce
13. You need to enable Identity360 as an authentication method so that users can select Identity360 as an authentication type on the Salesforce login screen. Navigate to Company Settings -> My Domain -> Authentication Configuration.
14. Click Edit. Select Identity360 as the Authentication Service and click Save.
    Salesforce authentication configuration

Identity360 (identity provider) configuration steps

1. Switch to Identity360's application configuration page.
2. In the Login Redirect URL field, paste the Callback URL copied from step 10 of salesforce configuration.
3. Choose the Scope that as required from the drop-down.

   Note: Scopes define the level of access that can be requested by the service provider to access a resource. Identity360 supports the following scopes:

   • openid: Establishes that this is an OpenID Connect request.
   • email: Requests the user's email attribute.
   • profile: Requests the user's profile claims (FirstName and LastName).
4. Click Save.
   Integration Settings of SSO configuration for Salesforce

To learn how to assign users and groups to one or more applications, refer to this page.

Your users should now be able to sign in to Salesforce through the Identity360 portal.

Steps to enable MFA for Salesforce

Setting up MFA for Salesforce using Identity360 involves the following steps:

1. Set up one or more authenticators for identity verification when users attempt to log in to Salesforce. Identity360 supports various authenticators, including FIDO2 passkeys, Google Authenticator, and email-based verification codes. Click here for steps to set up the different authenticators.
2. Integrate Salesforce with Identity360 by configuring SSO using the steps listed here.
3. Now, activate MFA for Salesforce by following the steps mentioned here.

How does MFA for applications work in Identity360?