How to configure single sign-on for Salesforce

ADSelfService Plus supports Active Directory (AD)-based single sign-on (SSO) for Salesforce and any other SAML-enabled application. Upon enabling SSO for Salesforce in ADSelfService Plus, all users have to do is simply log in to their Windows machines using their AD domain credentials. Once logged in, users can securely access Salesforce in one click without having to enter their username and password again. 

ADSelfService Plus supports both Identity Provider (IdP) and Service Provider (SP)-initiated SSO for Salesforce.

IdP-initiated SSO for Salesforce: Users need to log in to the ADSelfService Plus self-service portal first, and then click on the Salesforce icon on the Applications dashboard to access Salesforce.

SP-initiated SSO for Salesforce: Users can access their Salesforce domain via a URL or bookmark. They will automatically be redirected to the ADSelfService Plus portal for login. Once they've signed on, they'll be automatically redirected and logged into the Salesforce portal.

Follow the step-by-step guide given below for Salesforce SSO

Before you begin

Download and install ADSelfService Plus if you haven’t already.

Configuring your Active Directory domain in ADSelfService Plus

With ADSelfService Plus, you can use the existing AD domain credentials of users for authentication during SSO. So, first you need to configure an AD domain in ADSelfService Plus to enable SSO for Salesforce.

ADSelfService Plus will try to automatically add all the domains that it can discover in your network. If your domains are automatically added, skip to Step 9; otherwise, follow Steps 1-8 to add them manually.

1. Launch the ADSelfService Plus web console and log in using admin credentials.
2. Click the Domain Settings link available on the top-right corner of the application.
3. An Add Domain Details window will appear.
4. In the Domain Name field, enter the name of the domain you want to add.
5. In the Add Domain Controllers field, click Discover. ADSelfService Plus will try to automatically discover the domain controllers associated with the domain.
6. If the domains are not auto-discovered, then enter the domain controller name in the field provided, and click Add.
7. You can leave the authentication fields empty if you're not going to use the end user self-service features of ADSelfService Plus.
8. Back in the Add Domain Details window, click Add to complete adding the domain in ADSelfService Plus.

Getting the SAML details from ADSelfService Plus

9. Navigate to Configuration → Self-service → Password Sync/Single Sign On.
10. Click Salesforce in the list of applications provided.
11. Click Download SSO Certificate in the top-right corner of the screen.
12. In the pop-up that appears, copy the Login URL, Logout URL, and download the SSO certificate by clicking the Download SSO Certificate button.

Configuring SSO settings in Salesforce.

13. Log in to Salesforce with administrator credentials.
14. Select Setup Single Sign-On (SSO) option from the Security Controls tab.

    

15. In the Single Sign-On Settings page, click Edit and select the SAML Enabled check box. Click Save.
16. Now, in the SAML Single Sign-On Settings section, click New.
17. Enter a Name and API Name for reference.
18. In the Issuer field, enter the Login URL value from Step 12.
19. In the Identity Provider Certificate field, click Choose File and upload the SSO certificate you downloaded in Step 12.
20. In the Identity Provider Login URL field, enter the Login URL value from Step 12.
21. In the Identity Provider Logout URL field, enter the Logout URL value from Step 12.

    

22. Click Save at the top.
23. Once you click Save, a Login URL will be displayed at the bottom in the Endpoints section. Copy the URL value and keep it safe.

    

24. Now, you need to configure the authentication method.
    • Navigate to Domain Management → Domain.

      

    • Under Authentication Configuration, click Edit.
    • Select the ADSelfService Plus SAML SSO configuration and click save.

Adding your Salesforce domain in ADSelfService Plus and enabling SSO

25. Now, switch to ADSelfService Plus’ Salesforce configuration page.
26. Choose Single sign-on under Modules.
27. In the SAML Redirect URL field, enter the Login URL from Step 23.
28. In the Domain Name field, enter the domain name for which you just enabled SSO.
29. In the Display Name field, provide an appropriate display name.
30. In the Available Policies field, click the drop-down box and select the policies for which you wish to enable SSO. The policy you select will determine which users have the SSO feature enabled.

    Note: ADSelfService Plus allows you to create OU and group-based policies for your AD domains. To create a policy, go to Configuration → Self-Service → Policy Configuration → Add New Policy. Click Select OUs/Groups, and make the selection based on your requirements. You need to select at least one self-service feature. Finally, click Save Policy.

31. Click Save.

Your users can now log into their Salesforce accounts automatically using single sign-on.