This article outlines the information and steps you need to take in order to configure Salesforce to use the Hypersocket SAML Identity Provider. Once configured your users will be redirected to your Hypersocket Server to authenticate.
Step 1 - Create the Resource from the Template
Log into your server as admin and navigate to Single Sign On -> SAML. Select Search Templates and select the Salesforce SAML template and click Next.
You will be asked for your Salesforce domain if you have one and organization Id.
Enter the domain name of your Salesforce account. If your Salesforce domain is 'hypersocket.salesforce.com' then your domain is url, 'hypersocket.salesforce.com'.
If you do not have a domain this value must be set to, 'https://saml.salesforce.com'.
Enter your Organization Id, this can be found under Setup -> Administer -> Company Profile -> Company Information within Salesforce, for example, '00D24000000jWBD'.
Click Next and you should be presented with this article. At this point click on the Goto Article link to open this article in a separate browser window so that you can return to the SAML list of resources where your Salesforce SAML resource should now be present.
Step 2 - Download SAML metadata
You will need a couple of things from your server in order to configure Salesforce. First you will need to download the SAML metadata.
In the table of SAML resources locate the Salesforce SAML resource, and click the options icon to activate the dropdown. Select Download Metadata; this is an XML file that contains information about the Identity Provider and its access points.
Next, navigate to Configuration->Certificates and locate the SAML RSA certificate. Again using the options icon to activate the dropdown, select Download Certificate
Before proceeding to the next step, open the XML file containing the metadata and locate the logon and logoff service URLs. These are located towards the end of the document and will look like
Copy the entire URL as these will be entered into the Salesforce settings.
Also take a copy of your entityId which will be located at the top and look something like,
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://hypersocket.salesforce.com">
Step 3 - Configure Salesforce
Once you have setup the SAML resource on your server you will now need to log into your Salesforce account as Administrator so that you can configure Salesforce to use a third party Identity Provider.
First, once logged in, select Setup and from the left navigation open Administer - > Security Control -> Single sign-On settings.
From the Single sign-On Settings page enable SAML.
From the SAML Single Sign-On Settings section select New. This will open a new SAML configuratiion page where you can configure Hypersocket SSO as the identity provider.
Configure the following settings:
- Name: a suitable name to identity this configuration
- API Name: this should be automatically generated based on the Name
- Issuer & IdentityId: use the entity Id identified in step 2 for example, 'https://nervepoint.5ocket.net'
- Identity Prpovider Certificate: upload the certificate located in step 2
- SAML Identity Type: this should be, 'Assertion contains User's salesforce.com username'.
- SAML Identity Location: this should be set to, 'Identity is in the NameIdentifier element of the Subject statement'.
- Identity Provider Login URL: Use the login URL identified in step 2
- Identity Provider Logout URL: Use the logout URL identified in step 2
Click Save to commit the settings.
Step 4 - Final Checks
One final step before you start using your Salesforce resource, ensure that you have assigned some Roles to it so that its available for users to use.
In addition, each user's email address must match their Salesforce logon email as this is the primary link between accounts.
Once access is assigned log out of Salesforce and then access Hypersocket as a user with the rights to use the new resource. In Browser Resources section under My Resources click the launch icon to access Salesforce.