> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Salesforce

You can configure Salesforce to use IDaaS for multi-factor authentication.

info

Before you begin, create a domain on Salesforce. Consult the Salesforce documentation for instructions.

## Integrate Salesforce OIDC with IDaaS

To integrate Salesforce with IDaaS, complete the following steps:

- [Step 1: Create custom user attributes for Salesforce OIDC](#step-1-create-custom-user-attributes-for-salesforce-oidc)
- [Step 2: Add Salesforce OIDC to IDaaS](#step-2-add-salesforce-oidc-to-idaas)
- [Step 3: Configure claims](#step-3-configure-claims)
- [Step 4: Configure customizations](#step-4-configure-customizations)
- [Step 5: Add a resource rule](#step-5-add-a-resource-rule)
- [Step 6: Optional. Add a resource server](#step-6-optional-add-a-resource-server)
- [Step 7: Modify the Auth. Provider settings in Salesforce](#step-7-modify-the-auth-provider-settings-in-salesforce)
- [Step 8: Modify the Salesforce OIDC settings in IDaaS](#step-8-modify-the-salesforce-oidc-settings-in-idaas)
- [Step 9: Test the integration](#step-9-test-the-integration)
- [Step 10: Add IDaaS to the Salesforce Logon page](#step-10-add-idaas-to-the-salesforce-logon-page)

### Step 1: Create custom user attributes for Salesforce OIDC

important

To use this configuration, the email system user attribute must be configured as mandatory. See [Create custom user attributes](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md) for instructions.

To create a custom user attribute:

1. Click Menu icon **>** **Members > Attributes**. The **User Attributes List** page appears.
2. Under **Custom User Attributes**, click **Circle Plus icon**. The **Add User Attribute** dialog box appears.
3. Enter a **User Attribute Name** for the custom user attribute.
4. Optional: Check **Required** to make the user attribute mandatory.
5. Click **Add** to create the attribute. The attribute now appears in the list of **Custom User Attributes**.

### Step 2: Add Salesforce OIDC to IDaaS

1. Log in to IDaaS.

2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.

3. Click **Add**. The **Select an Application Template** page appears.

4. Do one of the following:

   - Click **OIDC** and select **Salesforce OIDC** from the list of **OpenID Connect and OAuth Cloud Applications**.
   - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS.

5. Click **Salesforce OIDC**. The **Add Salesforce OIDC** page appears.

6. If required, modify the following **App Settings**:

   - **Application Name**
   - **Application Description**

7. Configure the **OIDC Settings**. Settings not described here can be left at the default values.

   1. Make note of the **Client ID** value. You enter this value as the **Consumer Key** during _Step 7: Modify the Auth. Provider settings in Salesforce_.

   2. Select **Client Secret Basic** from the **Client Authentication Method** drop-down list. When using the token, PAR, or revocation endpoints, clients use this authentication method to authenticate to the Authorization Server.

   3. Do one of the following:

      - Copy (or update and copy) the **Client Secret** value. You can then paste the **Client Secret** value into the required field of your client OIDC application account settings.

      - Optional. Set and copy the **Client Secret (Alternative)** value as an alternative option to support client secret rollover. You can then paste the **Client Secret (Alternative)** value into the required field of your client OIDC application account settings.

      note
      You can define your own Client Secret values. However, Entrust recommends that you use the strong secret value provided. You can also optionally view or regenerate a new client secret.

   4. Set the **Reauthentication Time (Max Authentication Age)** to the maximum amount of time that can elapse before a user must reauthenticate to log in. This feature is disabled if the field is left blank.

   5. Select the **OIDC Signing Certificate** used to connect to the Salesforce OIDC.

   6. From the **ID Token Signing Algorithm** drop-down list, select **RS256** as the signing algorithm used to sign with ID Token during authentication.

   7. From the **UserInfo Signing Algorithm**, select **none**.

   8. In the **Add Login Redirect URI** field,

      1. Enter `https://todo.com`.
      2. Click **OK**.

   9. Select **Require Consent** to require that users respond to a consent prompt for each request.

   10. Optional. Enter a **Consent Message** to include a message to users when consent is requested.

   11. Under **Grant Types**, select **Authorization Code**. The Grant Type tells IDaaS what flow to use for returning authorization responses.

   12. From the **Authorization Code PKCE Code Challenge Method** drop-down list*, select **None** as the method used with PKCE during authentication.

   13. Do not modify the current setting for the **Subject ID Attribute** that is included in the ID token and access token to identify the user being authenticated.

   14. Optional. Enter a **Custom Consent Message** to include a message to users when consent is requested.

   15. The authorization request uses **Supported Scopes** to establish a connection between IDaaS and the Salesforce OIDC application. Supported Scopes are selected by default. If you disable **Your unique identifier**, the Salesforce OIDC application strictly uses an access token to access a resource server API on behalf of a user.

   note
   Click the arrow next to each scope to see the list of **Implied Claims** included in the scope. The list of **Implied Claims** is defined by OpenID Connect and cannot be modified. Every Implied Claim included in the scopes you select under **Supported Scopes** should have an associated IDaaS user attribute so that the attribute is returned as part of the OIDC tokens sent back to the client. For example, if you select Address as a Supported Scope, then you must define an IDaaS user attribute for each **Implied Claim** associated with Address. See [Create and manage user attributes](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md) for instructions to create user attributes.

   16. Do not modify any of the **Supported Claims selected** settings.

   17. Copy the **Registration Handler Script**.

8. Click **Save**.

9. Proceed to _Step 3: Configure claims._

### Step 3: Configure claims

1. Click the **Claims** tab. The **Claims** page appears.

2. If required, add additional **Supported Claims** to map OIDC claims to IDaaS user attributes.

   The supported claims define the claims that are requested by the client during an authorization request. A claim is an IDaaS user attribute, for example, `first name`. The user attribute must be included if that claim is requested by the client during an authorization request. The required claims depend on the OIDC application that you are configuring on IDaaS.

   You can group claims, for example, the default claim, name, includes the user attribute `First Name`, a text-based value of a space and the user attribute value of `Last Name` so that the claim returned to the client is First Name `<space>` Last Name, for example `Alice Gray`.

3. To add a claim:

   1. Ensure that you have already created the required User Attributes in IDaaS (see [Create and manage user attributes](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md)).

   2. Click Circle Plus icon. The **Add Claim** dialog box appears.

   3. In the **Claim Name** field, do one of the following:

      1. Select the **Claim Name** from the drop-down list.
      2. Type a **Claim Name** to create a new custom claim.

   4. In the **Enter the Claim value expected by the Service Provider** field, enter the following, as required:

      - **User Attribute Value.** An IDaaS user attribute (see [Create and manage user attributes](/docs/people-and-access/manage-members/create-and-manage-user-attributes.md)).
      - **Text Based Value.** A text based value. For example, to add a space between two claims or add text information.
      - **Related Value.** Include user group or authenticator attributes. See [Configure OIDC claim to include user authenticators or groups](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/configure-an-oidc-and-oauth-claim.md).

      > Example: `some text <first Name> <Last Name> [Groups]`

   5. Select **Always Return with User Info** to always return the user information with the claim.

   6. Select **Always Return with ID Token** to always return the ID Token with the claim.

   7. Click **Add**.

   info
   If required, click Pencil icon next to the claim and make the required changes. Click Trash icon to delete a claim.

4. Click **Save**.

5. Proceed to _Step 4: Configure customizations_.

### Step 4: Configure customizations

1. Click the **Customization** tab. The **Customization** page appears.
2. Deselect **Enable Go Back Button** if you do not want users to be able to go back to the application login page to log in.
3. Optional: Select **Respond Immediately for Unsuccessful Responses** to return to the application immediately after a login failure, rather than allow the user to try again with a different user ID.
4. Optional: Deselect **Show Login Redirect URL in My Profile** to hide the application from a user's profile.
5. Optional. Add a custom application logo, as follows:
   1. Click Circle Plus icon next to **Application Logo**. The Upload Logo dialog box appears.
   2. Click Arrow Up From Line icon to select an image file to upload.
   3. Browse to select your file and click **Open**. The **Upload Logo** **dialog box** displays your selected image.
   4. If required, resize your image.
   5. Click **OK**.
6. Select the **Login Options** that appear to users during login. You must select at least one. For details on each login option and requirements, see [Manage login options](/docs/applications-and-sso/manage-applications/manage-login-options.md).
7. Click **Save**.
8. Proceed to _Step 5: Add a resource rule._

### Step 5: Add a resource rule

See [Create resource rules](/docs/authentication-and-security/create-and-manage-resource-rules.md).

### Step 6: Optional. Add a resource server

1. Click the **Resource Servers** tab.
2. Click **Add Resource Server**.
3. Follow the instructions in [Add an API/URL resource server](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/manage-resource-servers/add-an-api-url-resource-server.md).

### Step 7: Modify the Auth. Provider settings in Salesforce

To complete this procedure, you need to have IDaaS open as you copy and paste information from IDaaS into Salesforce.

1. Log in to your Salesforce administrator account.

2. Click the cogwheel (Settings icon) and click **Service Setup**.

3. In the Navigation pane, click **Identity > Auth Providers**. The **Auth Providers** page appears.

4. Click **New**. The **Auth. Provider Edit** page appears.

5. From the **Provider Type** drop-down list, select **Open ID Connect.**

6. In the **Name** text box, enter **IDaaS**. The **URL Suffix** is auto-populated with the same value.

7. In IDaaS, go to Menu icon **>** **Resources** > **Applications**. The **Applications** page appears.

8. Click **Salesforce OIDC** and click **Next** on the **Edit Salesforce OIDC** page. The **Salesforce OIDC Settings** page appears.

9. Copy the **Client ID** from the Salesforce OIDC settings in IDaaS and paste it in the **Consumer Key** text box on the **Salesforce Auth. Provider** page.

10. Copy the **Client Secret** value from the Salesforce OIDC settings in IDaaS and paste it in the **Consumer Secret** text box on the **Salesforce Auth. Provider** page.

11. In IDaaS, go to Menu icon **>** **Resources** > **Applications**. The **Applications** page appears.

12. Click **OIDC Configuration**. The **OIDC Configuration** page appears.

13. Use the information on the IDaaS **OIDC Configuration** page as reference for the next steps.

14. On the **Salesforce Auth. Provider** page, enter the following:

    1. In the **Authorize Endpoint URL** text box, enter

       `<IDaaS_account_URL>/api/oidc/authorize`

    2. In the **Token Endpoint URL** text box, enter

       `<IDaaS_account_URL>/api/oidc/token`

    3. In the **User info Endpoint URL** text box, enter

       `<IDaaS_account_URL>/api/oidc/userinfo`

    4. In the **Token Issuer** text box, enter

       `<IDaaS_account_URL>/api/oidc`

    5. Optional: In the **Custom Error URL** text box, you can leave it blank or enter

       `<IDaaS_account_URL>/api/oidc/errors`

    6. Optional: In the **Custom Logout URL** text box, enter

       `<IDaaS_account_URL>/api/oidc/endsession`

       When set, the user is logged out of IDaaS when they log out of Salesforce. You can also leave this field blank.

    info
    This will not log you out of IDaaS when you log out of Salesforce but will redirect you back to IDaaS.

15. Check **Send access token in header**.

16. In the **Default Scopes** text box, enter openid email profile. (Do not include commas. The scopes must be entered separated by spaces.)

17. Select **Send client credentials in header**. This setting confirms that the client credentials are sent properly to the OIDC Provider.

18. Click **Automatically create a registration handler template** as the **Registration Handler**.

19. Click the **Execute Registration** search icon and select your Salesforce account user name.

20. Set an **Icon URL**, as follows:

    - Enter the URL of a custom icon.
    - Click **Choose one of our sample icons** and select an icon. A URL appears. Copy and paste that URL into the **Icon URL** text box.

21. Click **Save**. The Auth. Provider is created. The Salesforce Configuration details appears.

info

Leave this page open. You need to reference the Salesforce Configuration URLs in the next procedure, _Step 8: Modify the Salesforce OIDC settings in IDaaS_.

### Step 8: Modify the Salesforce OIDC settings in IDaaS

1. You need to reference the Salesforce Auth. Provider settings to complete this procedure.

2. Log in to an IDaaS account with a role assigned that allows the configuration of applications on IDaaS.

3. Click Menu icon **>** **Resources > Applications**. The **Applications** page appears.

4. Click the name of the Salesforce application you configured for OIDC and then click **Next**. The **Settings** page appears.

5. In the **Initiate Logon URI** text box, enter the **Single Sign-On Initialization URL**. The URL is listed in the Salesforce Configuration list on the **Salesforce Auth Providers** page.

6. In the **Login** **Redirect URIs** field, click Circle Plus icon, enter the **Callback URL**, and then click **Add**. The URL is listed in the Salesforce Configuration list on the **Salesforce Auth Providers** page.

note
The login redirect URI hostname is added as a valid CORS origin for OIDC processing.

7. Scroll down to the **Registration Handler Script**.

8. Click **Copy To Clipboard** to copy the registration handler script.

9. Return to the **Auth. Provider** page of your Salesforce account.

10. Click the **Registration Handler** link, for example, `AutocreatedRegHandler12345678`. The **Apex Classes** page appears with the **Registration Handler** code.

11. Click **Edit**.

12. Delete all of the code.

13. Paste the IDaaS **Registration Handler Script** that you copied to the clipboard in Step 8.

14. Click **Save**.

### Step 9: Test the integration

Test the integration between your Salesforce and IDaaS accounts to confirm that your settings have been configured correctly.

1. Log in to your Salesforce administrator account.
2. Click **Settings** **>** **Identity > Auth Providers**. The **Auth Providers** page appears.
3. Click the name of your Auth. Provider configuration. The configuration settings appear.
4. Copy and paste the **Test-Only Initialization URL** into a new web browser address bar. You are directed to IDaaS for authentication if your settings are correct.
5. Enter the **User ID** of the IDaaS user that needs OIDC access, and click **Next**. IDaaS presents the challenge. By default, you are prompted to authenticate using your highest ranking active authenticator.
6. Respond to the authentication challenge.
7. Click **Login** if required. You are asked to allow access to the information included in the scopes or claims. You set these set the scopes when you configured IDaaS with Salesforce.
8. Click **Allow**. You can now access your Salesforce account through IDaaS.

### Step 10: Add IDaaS to the Salesforce Logon page

1. Log in to your Salesforce administrator account.
2. In the navigation pane, go to **Settings >My Company > My Domain**. The **My Domain** page appears.
3. Under **Authentication Configuration**, click **Edit** and change the value entered in **Your domain name** to the domain name of your Salesforce account configured for IDaaS authentication.
4. Click **Save**.
5. Under **Authentication Configuration**, click **Edit** and select the name of your authentication service as an **Authentication Service**.
6. Deselect **Login Page** as an Authentication Service.
7. Click **Save**.
8. Test logging in to Salesforce from your IDaaS account to confirm that the configuration was successful.