Skip to content

Log in to Salesforce using the Identity Server

This page guides you through using WSO2 Identity Server to log in to Salesforce.

Configure Salesforce

  1. Sign up as a Salesforce developer.

    1. Fill out the relevant information found in the following URL: https://developer.salesforce.com/signup
    2. Click Sign me up.
    3. Click Allow to enable Salesforce to access your basic information. This message pops up only when you log in to Salesforce for the first time.
    4. You will be navigated to the lightening theme of Salesforce.

    welcome-to-lightening.png

    Note

    This document is explained using the Salesforce lightning theme. If you are using the classic theme, click Switch to Lightning Experience on the top panel.

    lighteninig-experience

  2. Once you are logged in, create a new domain and access it. To do this, do the following steps.

    1. Search for My Domain in the search bar that is on the left navigation panel.
      my-domain

    2. Click My Domain.

    3. On the page that appears, come up with a name for your domain. You can check if the domain is available by clicking the Check Availability button.

      Info

      For the page given below to load on your browser, make sure that the Salesforce cookies are not blocked.

      sales-force-cookies

    4. If the domain is available, click Register Domain to register your new domain.

    5. The verification might take a few minutes. On successful verification, you will proceed to step 3 where you can test your login.

    6. Click Log in.

  3. On the left navigation menu, search for Single Sign-On Settings and click on it.

  4. On the page that appears, click Edit and then select the SAML Enabled check box to enable federated single sign-on using SAML.
    saml-enabled

  5. Click Save.

  6. Click New under SAML Single Sign-On Settings. The following screen appears.
    saml-sso-setting

    Ensure that you configure the following properties.

    Field Value
    Name SSO
    API Name SSO
    Issuer localhost
    Entity Id https://saml.salesforce.com
    Identity Provider Certificate

    wso2.crt

    Note

    To create the Identity Provider Certificate, open the terminal, traverse to the <IS_HOME>/repository/resources/security directory. Next, execute the following command. 

    keytool -export -alias wso2carbon -file wso2.crt -keystore wso2carbon.jks -storepass wso2carbon

    Once this command is run, the wso2.crt file is generated and can be found in the <IS_HOME>/repository/resources/security directory. Click Choose File and navigate to this location in order to obtain and upload this file.

    Request Signing Certificate Default Certificate
    Request Signature Method RSA-SHA1
    Assertion Decryption Certificate Assertion not encrypted
    SAML Identity Type

    Assertion contains user's salesforce username
    SAML Identity Location

    Identity is in the NameIdentifier element of the Subject statement
    Service Provider Initiated Request Binding HTTP POST
    Identity Provider Login URL https://localhost:9443/samlsso
    Custom Logout URL https://localhost:9443/samlsso
    Custom Error URL Leave blank
    User Provisioning Enabled Leave blank

    Click Save to save your configurations.

  7. Navigate to Company Settings in the left navigation pane and click My Domain.

  8. Click Deploy to Users. Click Ok to the confirmation message that appears.

  9. On the page that appears, you must configure the Authentication Configuration section. Scroll down to this section and click Edit.

  10. Under Authentication Service, select SSO instead of Login Page.
    authentication-service-sso

  11. Click Save.

Configure Email Address as the Username

Warning

Configuring the email address as the username in an already running Identity Server is not the production recommended way. Therefore, make sure to configure it before you begin working with WSO2 IS.

  1. Log in to the Management Console and click Claims > List > http://wso2.org/claims.

  2. Click the Edit link corresponding to the Username claim and configure the Mapped Attribute property to mail.

    email-as-username-attribute-mapping

  3. Click Update to save the changes.

  4. Open the <IS_HOME>/repository/conf/deployment.toml file.

  5. Add the following configuration to enable email authentication.

    [tenant_mgt]
enable_email_domain= true

  6. Configure the following set of parameters in the userstore configuration, depending on the type of userstore you are connected to (LDAP/Active Directory/ JDBC).

    Parameter Description

    UserNameAttribute


    Set the mail attribute of the user. LDAP/Active Directory only

    [user_store]
    user_name_attribute = "mail"
    UserNameSearchFilter

    Use the mail attribute of the user instead of cn or uid . LDAP/Active Directory only
    For example:

     In LDAP,[user_store]
    user_name_search_filter = "(&amp;(objectClass=person)(mail=?))"     
     In Active Directory, [user_store]
    user_name_search_filter = "(&amp;(objectClass=user)(mail=?))"
    UserNameListFilter

    Use the mail attribute of the user if necessary. LDAP/Active Directory only
    For example:

     In LDAP,[user_store]
    user_name_list_filter = "(&amp;(objectClass=person)(!(sn=Service)))"     
     In Active Directory, [user_store]
    user_name_list_filter = "(&amp;(objectClass=user)(!(sn=Service)))"
    UsernameJavaScriptRegEx

    Change this property that is under the relevant userstore manager tag as follows. This property allows you to add special characters like "@" in the username.

    [user_store]
    username_java_script_regex = '^[a-zA-Z0-9.-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4}$'
    UsernameJavaRegEx

    This is a regular expression to validate usernames. By default, strings have a length of 5 to 30. Only non-empty characters are allowed. You can provide ranges of alphabets, numbers and also ranges of ASCII values in the RegEx properties.

    [user_store]
    username_java_regex = '^[a-zA-Z0-9.-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4}'
    Realm configurations

    The username must use the email attribute of the admin user.

    [super_admin]
    username = "[email protected]"
    password = "admin"

    Note

    Before this configuration, the user having the username admin and password admin was considered the super administrator. The super administrator user cannot be deleted.

    After this configuration, the user having the username [email protected] is considered the super administrator. The user having the username admin is considered as a normal administrator.

    Info

    • With these configuration users can log in to super tenant with both email username ([email protected]) or non-email usernames (larry). However, for tenants, only email usernames are allowed. ([email protected]@wso2.com).
    • You can configure email username without enabling the enable_email_domain property (step 5). Then users can log in to both the super tenant and the tenant using email and non-email usernames. However, super tenant users should always use @carbon.super at the end of usernames.

  7. Restart the server.

Create the service provider

To register your application as a service provider in the WSO2 Identity Server:

  1. Log in to the WSO2 Identity Server Management Console using administrator credentials.

  2. Go to Main > Identity > Service Providers > Add.

  3. Enter a Service Provider Name. Optionally, enter a Description.

  4. Click Register.

SAML Configurations

Make the following changes to the created service provider.

  1. Expand Inbound Authentication Configuration > SAML Configuration and click Configure.

  2. Enter the Issuer as https://saml.salesforce.com.

    Note

    The Issuer is the unique identifier of the service provider. This is also the issuer value specified in the SAML Authentication Request issued by the service provider.

  3. Enter Assertion Consumer URL and click Add.

    Note

    The Assertion Consumer URL is the URL of the page to which the browser is redirected to after successful authentication. To obtain the Assertion Consumer URL from Salesforce, follow the below provided steps.
    1. Navigate to Identity > Single Sign-On Settings from the left hand side panel.
    2. Click on the name of the SAML SSO component created.
    3. Note down the login URL.

  4. Select Enable Response Signing to sign the SAML2 Responses returned after the authentication process.

  5. Select Enable Attribute Profile and Include Attributes in the Response Always so that the the identity provider will always include the attribute values related to the selected claims in the SAML2 attribute statement.

  6. Click Register.

Tip

To configure more advanced configurations, see Advanced SAML Configurations.

Test the configurations

Do the following steps to test out the configurations for a new user in Salesforce and the Identity Server.

  1. Create a user in WSO2 IS.

    1. Log in to the WSO2 Identity Server Management Console (https://<IS_HOST>:<PORT>/carbon) using administrator credentials (admin:admin).

  2. Navigate to Main > Identity > Users and Roles > Add.

  3. Click Add New User and enter username and password.  When adding a new user, use an email address as the username. Since it is not mandatory to assign a role to a user in this tutorial, click Finish.

  4. Create a user in Salesforce. This user should have the same email address as the user in WSO2 IS

    1. Log in to the Salesforce developer account: https://login.salesforce.com/.
    2. On the left navigation pane, under ADMINISTRATION, click Users under Users.
    3. On the page that appears, click the New User button to create a new user.

    4. Create a user with the same username as the one you created in WSO2 Identity Server. Click Save to save your changes. An email will be sent to the email address you provided for the user.

      Note

      This is mainly for testing purposes. In a real business scenario, you would be more likely to use Just-In-Time (JIT) provisioning to provision a user to Salesforce.

  5. Access your Salesforce login URL on an incognito or private browser.

    Info

    The salesforce login URL is unique to your Salesforce application. Follow the steps given below to get this URL:

    1. Search for My Domain in the search bar that is on the left navigation panel.

    2. Click My Domain and you are navigated to the domain you created under the section, Configure Salesforce.

    3. Click Edit under Authentication Configurations and you are navigated to a new page having the following URl: https://<DOMAIN_NAME>/domainname/EditLogin.apexp.

    4. On the left navigation menu, expand Security Controls, and click, Single Sign-On Settings.

    5. Click on the name of the created Single Sign-On Setting. For this example, click SSO.
      single-sign-on-setting

    6. Copy the URL that is defined for Login URL to access Salesforce.
      login-url-for-salesforce

  6. Log in using the new credentials of the user you just created. You are then redirected back to Salesforce.

Troubleshooting guidelines

Additional troubleshooting information regarding any Salesforce side SSO failures can be retrieved by using Salesforce SAML Assertion Validator. Further information regarding the steps are available here.

Related topics

Top