• Home
• App Integrations
• Single Sign-On Integrations
• Salesforce SSO

Configure Salesforce SAML Single Sign-On (SSO)

---

Streamline the configuration of Salesforce SSO with this comprehensive setup guide provided by miniOrange. Our SAML Single Sign-On (SSO) solution enables seamless login to Salesforce Channels and various applications using a unified set of credentials. By enabling SSO for Salesforce, users can securely access Salesforce with just one click, eliminating the need to re-enter their username and password. Simplify your Salesforce authentication process and enhance security with miniOrange's user-friendly SSO solution.

With miniOrange Salesforce SSO, you can:

• Enable your users to automatically login to Salesforce
• Have centralized and easy access control of the users
• Connect easily with any external identity source like Azure AD, ADFS, Cognito, etc

Supported SSO Features

miniOrange-Salesforce SAML integration supports the following features:

• SP Initiated SSO Login: Users can access their Salesforce account via a URL or bookmark. They will automatically be redirected to the miniOrange portal for log in. Once they've signed on, they'll be automatically redirected and logged into Salesforce.
• IdP Initiated SSO Login: Users need to log in to the miniOrange first , and then click on the Salesforce icon on the applications dashboard to access Salesforce.(If you have set up any more Identity Sources, you will log in to that platform).
• JIT Provisioning: Enables the automatic creation of user accounts in Salesforce when a person logs in for the first time via Desktop SSO, IDP, or Active Directory (AD) authentication.
• Single Logout: With this feature, you will be automatically logged out of all the Salesforce applications that are connected with Identity provider (IdP) when you log out from Salesforce org or any other app.
• Mandate users to Login using SSO: Single Sign-on can make it mandatory for all Salesforce users to log in using SSO. This will prevent any person from logging win using any other source and bypassing the login system. No person will be able to have direct login making it a streamline and secure process.

Prerequisites

• The following Subscription plans are required for the mentioned authentication methods:
  1. Federated Authentication: All Editions
  2. Delegated Authentication Professional, Enterprise, Performance, Unlimited, Developer, and How you integrate Editions.
  3. Authentication Providers: Professional, Enterprise, Performance, Unlimited, and Developer Editions.
• Note - In order to do SP initiated SSO into Salesforce, you need to create a custom Domain. Check this link - Salesforce domain changes and follow the below steps:

• Salesforce Lightening
• Salesforce Classic

• Login to your Salesforce account.
• Click on the Setup icon in the top-right section of the Salesforce lightening dashboard page.



• Now in the search field, search for the My Domain Settings.
• Choose your domain name, check for availability and if available, proceed by saving the settings.



• Search for Company Information in the search bar.
• Copy the Organization Id. (This will be required later)



• Salesforce Metadata: After you have set up the SSO settings in Salesforce Admin Dashboard, you will get the Salesforce Metadata File. Click Download Metadata to download an XML file of your SAML configuration settings to send to your identity provider. The identity provider can then upload these configuration settings to connect to your Experience Cloud site.

• Login to your Salesforce account.
• Go to Setup in the top-right section of the Salesforce classic dashboard page.



• Now in the left pane, select Domain Management.
• Select My Domain.
• Choose your domain name, check for availability and if available, proceed by clicking the Register Domain button.



• Test your domain once it is ready, by clicking the link and then click Deploy to Users.
• Search for Company Information in the search bar.
• Copy Organization Id. (This will be required later)

Follow the step-by-step guide given below for Salesforce Single Sign-On (SSO)

• Enter the following values in the respective fields.
1. Application Name : Salesforce
2. SP Entity ID or Issuer : https://[yourdomain].my.salesforce.com/
3. ACS URL : https://[yourdomain].my.salesforce.com/?so=[organization_id]
4. Single Logout URL : https://[yourdomain].my.salesforce.com
5. Sign Response : ON



• Click Next. Now, in the Attribute Mapping, Click on Add Attribute and enter the attribute names with their values as shown below.

  (Follow the steps given here to find out Salesforce profileId.)




• Click on Save.
• Your application is saved successfully. Now click on the Select button against your newly created application. Go to Metadata.



• On the Metadata page, click on Show Metadata Details and choose either of the two Metadata options :
• If you want to use miniOrange as User-Store i.e., your employee identities will be stored in miniOrange then download the metadata file under the heading 'INFORMATION REQUIRED TO SET MINIORANGE AS IDP'.
• If you want to authenticate your employees via any external Identity Provider (IDP) like Active Directory, Okta, OneLogin, Google, Apple ID, etc then download the Metadata file under the heading 'INFORMATION REQUIRED TO AUTHENTICATE VIA EXTERNAL IDPS'.



• Keep SAML Login URL, SAML Logout URL, IdP Entity ID or Issuer and click on the Download Certificate button to download the certificate which you will require in Step 2.

2. Configure SSO in Salesforce Admin Account

• Salesforce Lightening
• Salesforce Classic

• Log in to your Salesforce account as Account Admin.
• Click the gear icon, then navigate to Setup > Identity > Single Sign-On Settings.

• Log in to your Salesforce account as Account Admin.
• Navigate to Setup > Security Controls > Single Sign-On Settings.

• On the Single Sign-On Settings page, click on Edit.




• Check the SAML Enabled box to enable the use of SAML Single-Sign On, then click on Save.




• Click New to open SAML Single Sign-On Settings.




• Enter the following values in the respective fields.
1. Issuer : IDP Entity ID/Issuer in miniorange metadata
2. Entity ID : https://[yourdomain].my.salesforce.com
3. Identity Provider Certificate : Upload Certificate from miniOrange metadata
4. Request Signature method : RSA-SHA256
5. Assertion Decryption Certificate : Not encrypted
6. SAML Identity Type : Assertion contains the User's Salesforce username
7. SAML Identity Location : Identity is in the NameIdentifier element of the Subject statement
8. Service Provider Initiated Request Binding : HTTP Redirect
9. Identity Provider Login URL : SAML Login URL in miniOrange metadata
10. Custom Logout URL : https://[yourdomain].my.salesforce.com
• Click on Save.




• Copy your Login URL value.

Troubleshooting

External References

• Salesforce Integrations with miniOrange
  
• Guide For Salesforce Community Single Sign On (SSO)
• Enable 2FA/MFA on top of SSO for Salesforce
• Enable Provisioning for Salesforce