The Web Forms and MVC example identity providers demonstrate both IdP and SP initiated single sign-on with Salesforce.
The following sections describe the configuration for the Web Forms identity and service providers but, with the appropriate changes, apply equally to the MVC example identity and service providers.
Configuring the Identity Provider
The saml.config file includes the following entry for the Salesforce partner service provider.
<PartnerServiceProvider Name="https://saml.salesforce.com"
WantAuthnRequestSigned="false"
SignResponse="true"
SignAssertion="false"
EncryptAssertion="false"
AssertionConsumerServiceURL="https://login.salesforce.com"/>
The web.config file identifies the partner service provider. This must specify the Saleforce service provider.
<add key="PartnerSP" value="https://saml.salesforce.com"/>
Configuring Salesforce as a Service Provider
Login as an administrator to Salesforce at:
https://login.salesforce.com
Select Setup > Security Controls > Single Sign-On Settings.
Enable SAML.
Specify the issuer, upload the identity provider's certificate and specify the login URL.
For example, the issuer is urn:componentspace:ExampleIdentityProvider, upload the idp.cer file, and specify http://test.componentspace.com/ExampleIdentityProvider/SAML/SSOService.aspx as the login URL.
Running the Example Identity Provider – IdP-Initiated SSO
Browse to:
http://localhost/ExampleIdentityProvider
You should then be presented with the identity provider login prompt.
Login using the user name and password of a user known to the identity provider.
The user account must also exist in Salesforce.
You may have to update the credentials section of the example identity provider’s web.config to include the user name.
Click the link to SSO to Salesforce.
The Saleforce main page should be displayed.
This means you’ve successfully completed a SAML v2.0 SSO and are logged in at Salesforce with your identity provider user name.
Browse to the IdP-Initiated login URL specified under the login information for the service provider in the Salesforce configuration. For example:
https://ap1.salesforce.com/idp/login?app=0sp90000000Kyvb
You should then be presented with the Salesforce login prompt.
Login using the user name and password of a user known to Salesforce.
The example service provider page should be displayed.
This means you’ve successfully completed a SAML v2.0 SSO and are logged in at the example service provider with your Salesforce user name.
Browse to the example service provider. For example:
http://test.componentspace.com/ExampleServiceProvider
You should then be presented with the Salesforce login prompt.
Login using the user name and password of a user known to Salesforce.
The example service provider page should be displayed.
This means you’ve successfully completed a SAML v2.0 SSO and are logged in at the example service provider with your Salesforce user name.
Configuring the Service Provider
The saml.config file includes the following entry for the Salesforce partner identity provider.
<PartnerIdentityProvider
Name="https://componentspace-dev-ed.my.salesforce.com"
SignAuthnRequest="false"
WantSAMLResponseSigned="true"
WantAssertionSigned="false"
WantAssertionEncrypted="false"
UseEmbeddedCertificate="true"
SingleSignOnServiceUrl="https://componentspace-dev-ed.my.salesforce.com/idp/endpoint/HttpRedirect"/>
The partner identity provider name must match with the issuer name generated by Salesforce. See section 10.6.5.
The web.config file identifies the partner identity provider. This must specify the Saleforce identity provider.
<add key="PartnerIdP" value=" https://componentspace-dev-ed.my.salesforce.com "/>
Configuring Salesforce as an Identity Provider
Login as an administrator to Salesforce at:
https://login.salesforce.com Select Setup > Security Controls > Identity Provider.
Enable the Identity Provider. The generated self-signed certificate is okay to use.
Add a service provider.
Specify the name as ExampleServiceProvider and the entity ID as urn:componentspace:ExampleServiceProvider.
Specify the ACS URL. For example:
http://test.componentspace.com/ExampleServiceProvider/SAML/AssertionConsumerService.aspx A start URL is not required.
Select user name as the subject type.
Select the user profiles which will have access to the service provider.
Note that if SAML is enabled as described in section 10.6.2, the identity provider role is delegated to the configured identity provider. To have Salesforce act as the identity provider, disable SAML.
Running the Example Service Provider – IdP-Initiated SSO
Browse to the IdP-Initiated login URL specified under the login information for the service provider in the Salesforce configuration. For example:
https://ap1.salesforce.com/idp/login?app=0sp90000000Kyvb
You should then be presented with the Salesforce login prompt.
Login using the user name and password of a user known to Salesforce.