Salesforce SAML 2.0
SSO integration using SAML requires FlexDeploy to be available from a HTTPS url.Â
Salesforce support SSO as an identity provider meaning you can log into an external service provider (i.e FlexDeploy) or relying party with your Salesforce credentials.
The following documentation is referenced from Salesforce. See Salesforce Single Sign-On documentation for more information.
To set up this SSO configuration, follow these instructions:
1. Enable Salesforce as an identity provider
Determine which certificate you want to use to enable your org to communicate with the service provider. You can use the default certificate or create your own. See Certificates and Keys.
By default, a Salesforce identity provider uses a self-signed certificate generated with the SHA-256 signature algorithm. If you want to use the default certificate, proceed to step 2.
To create a new self-signed certificate, follow the instructions in Generate a Self-Signed Certificate. These instructions will be using a self-signed certificate.
To create a CA-signed certificate, follow the instructions in Generate a Certificate Signed by a Certificate Authority
From Setup, in the Quick Find box, enter Identity Provider, then select Identity Provider.
Click Enable Identity Provider.
Select a certificate from the dropdown menu.
Save your changes.
Click Download Certificate. This is typically .crt file. FlexDeploy will use the certificate to connect to Salesforce.
Copy the URL of Salesforce Identity (SF_METADATA_URL) as this will be used to connect to Salesforce.
2. Integrate FlexDeploy as a SAML-enabled connected app
Use the New Connected App wizard to define a connected app.
In Lightning Experience, you use the App Manager to create connected apps. From Setup, enter App in the Quick Find box, then select App Manager. Click New Connected App.
In Salesforce Classic, from Setup, enter Apps in the Quick Find box, then select Apps. On that page under Connected Apps, click New.
Configure settings for the connected app.
Under Basic Information
Name your app - i.e FlexDeploy
Enter your own email address
Under Web App Settings
Select Enable SAML.
For Entity Id, enter https://HOST:PORT/flexdeploy/callback?client_name=SAML2Client
For ACS URL, enter https://HOST:PORT/flexdeploy/callback?client_name=SAML2Client
For Start URL, enter https://HOST:PORT/flexdeploy
For Subject Type, select Username.
For Name ID Format, select urn:oasis:names:tc:SAML:2.0:nameid-format:persistent.
For Issuer, keep the default value, your subdomain.
In the field IdP Provider Certificate, keep the default (unselected).
For Verify Request Signatures, keep the default (unselected).
Click Save.
Under Profiles or Permission Sets, add the profiles or permissions sets of the users who can access this connected app
3. Import SSO Certificate from Salesforce into FlexDeploy keystore
You can use the same keystore which was created as part of the HTTPS configuration, or create one using the below command: This will also create a PrivateKeyEntry
keytool -genkey -alias flexdeploy -keyalg RSA -keystore /u01/flexdeploy/sso/flexdeploy.keystore
Import the certificate from step 1 into the keystore (adjust parameters below as appropriate).
keytool -import -alias salesforce -file /var/tmp/self_signed.cert -keystore /u01/flexdeploy/sso/flexdeploy.keystore
If you didn’t already create a private key for the purpose of https, perhaps due to using a load balancer, or create one from -genkey command you will need to generate a private key with a password.
keytool -genkey -keyalg RSA -alias flexdeployserver -keystore /home/oracle/flexdeploy.keystore -validity 3650 -keysize 2048
4. FlexDeploy Realm Config
Go to Realms and Enable Single Sign-On.
Click fdSSO to edit the SSO config. Replace capitalized text with appropriate values. Update values in the configuration file as shown below.
FLEXDEPLOY_HOME - Directory on the server where FlexDeploy is installed
KEYSTORE_PASSWORD - The Java key store password.
PRIVATE_KEY_PASSWORD -The private key password.
SF_METADATA_URL - The Metadata URL (from Salesforce) to the identity provider metadata (e.g. https://flexagon9-dev-ed.my.salesforce.com/.well-known/samlidp.xml).
FLEXDEPLOY_HOST - FlexDeploy application host
FLEXDEPLOY_PORT - FlexDeploy application port
ENTITY_ID - The Entity Id found in the connected app (e.g https://app-poc-e15b5cfc83cc.azurewebsites.net/flexdeploy/callback?client_name=SAML2Client).
PATH_TO_YOUR_KEYSTORE_FILE - The path to the keystore, including the file name and extension.
Example fdSSO realm configuration (SAML 2.0)
Configuration Tips
If the Java keystore referenced (line 3) does not exist, it will automatically be created, and key will be generated and inserted into the keystore using the passwords provided (line 3 and 4).
Property replacement syntax can be used within the Realm configuration to retrieve a Credential value. It is replaced at runtime.
5. Group Mapping with Salesforce SAML
Add a group Custom Attribute in Salesforce.
Open your connected app (App Manager → find your app)
Click New under Custom Attributes
Set the key to groups then click Insert Field to add the $UserRole.Name.
6. Restart FlexDeploy to apply configuration changes
Login to Identity Provider - Salesforce
Go to Start URL defined by your connected app, and it should redirect you to FlexDeploy new user page if its your first time logging in.
Done!
- style