Salesforce

You can configure Salesforce to use IDaaS for multi-factor authentication.

info

Before you begin, create a domain on Salesforce. Consult the Salesforce documentation for instructions.

Integrate Salesforce OIDC with IDaaS

To integrate Salesforce with IDaaS, complete the following steps:

• Step 1: Create custom user attributes for Salesforce OIDC
• Step 2: Add Salesforce OIDC to IDaaS
• Step 3: Configure claims
• Step 4: Configure customizations
• Step 5: Add a resource rule
• Step 6: Optional. Add a resource server
• Step 7: Modify the Auth. Provider settings in Salesforce
• Step 8: Modify the Salesforce OIDC settings in IDaaS
• Step 9: Test the integration
• Step 10: Add IDaaS to the Salesforce Logon page

Step 1: Create custom user attributes for Salesforce OIDC

important

To use this configuration, the email system user attribute must be configured as mandatory. See Create custom user attributes for instructions.

To create a custom user attribute:

1. Click > Members > Attributes. The User Attributes List page appears.
2. Under Custom User Attributes, click . The Add User Attribute dialog box appears.
3. Enter a User Attribute Name for the custom user attribute.
4. Optional: Check Required to make the user attribute mandatory.
5. Click Add to create the attribute. The attribute now appears in the list of Custom User Attributes.

Step 2: Add Salesforce OIDC to IDaaS

1. Log in to IDaaS.

2. Click > Security > Applications. The Applications List page appears.

3. Click Add. The Select an Application Template page appears.

4. Do one of the following:

   • Click OIDC and select Salesforce OIDC from the list of OpenID Connect and OAuth Cloud Applications.
   • In the Search bar, enter a search option to filter for the application you want to add to IDaaS.

5. Click Salesforce OIDC. The Add Salesforce OIDC page appears.

6. If required, modify the following App Settings:

   • Application Name
   • Application Description

7. Configure the OIDC Settings. Settings not described here can be left at the default values.

   1. Make note of the Client ID value. You enter this value as the Consumer Key during Step 7: Modify the Auth. Provider settings in Salesforce.

   2. Select Client Secret Basic from the Client Authentication Method drop-down list. When using the token, PAR, or revocation endpoints, clients use this authentication method to authenticate to the Authorization Server.

   3. Do one of the following:

      • Copy (or update and copy) the Client Secret value. You can then paste the Client Secret value into the required field of your client OIDC application account settings.

      • Optional. Set and copy the Client Secret (Alternative) value as an alternative option to support client secret rollover. You can then paste the Client Secret (Alternative) value into the required field of your client OIDC application account settings.

        note

        You can define your own Client Secret values. However, Entrust recommends that you use the strong secret value provided. You can also optionally view or regenerate a new client secret.

   4. Set the Reauthentication Time (Max Authentication Age) to the maximum amount of time that can elapse before a user must reauthenticate to log in. This feature is disabled if the field is left blank.

   5. Select the OIDC Signing Certificate used to connect to the Salesforce OIDC.

   6. From the ID Token Signing Algorithm drop-down list, select RS256 as the signing algorithm used to sign with ID Token during authentication.

   7. From the UserInfo Signing Algorithm, select none.

   8. In the Add Login Redirect URI field,

      1. Enter https://todo.com.
      2. Click OK.

   9. Select Require Consent to require that users respond to a consent prompt for each request.

   10. Optional. Enter a Consent Message to include a message to users when consent is requested.

   11. Under Grant Types, select Authorization Code. The Grant Type tells IDaaS what flow to use for returning authorization responses.

   12. From the Authorization Code PKCE Code Challenge Method drop-down list*, select None as the method used with PKCE during authentication.

   13. Do not modify the current setting for the Subject ID Attribute that is included in the ID token and access token to identify the user being authenticated.

   14. Optional. Enter a Custom Consent Message to include a message to users when consent is requested.

   15. The authorization request uses Supported Scopes to establish a connection between IDaaS and the Salesforce OIDC application. Supported Scopes are selected by default. If you disable Your unique identifier, the Salesforce OIDC application strictly uses an access token to access a resource server API on behalf of a user.

       note

       Click the arrow next to each scope to see the list of Implied Claims included in the scope. The list of Implied Claims is defined by OpenID Connect and cannot be modified. Every Implied Claim included in the scopes you select under Supported Scopes should have an associated IDaaS user attribute so that the attribute is returned as part of the OIDC tokens sent back to the client. For example, if you select Address as a Supported Scope, then you must define an IDaaS user attribute for each Implied Claim associated with Address. See Create and manage user attributes for instructions to create user attributes.

   16. Do not modify any of the Supported Claims selected settings.

   17. Copy the Registration Handler Script.

8. Click Save.

9. Proceed to Step 3: Configure claims.

Step 3: Configure claims

1. Click the Claims tab. The Claims page appears.

2. If required, add additional Supported Claims to map OIDC claims to IDaaS user attributes.

   The supported claims define the claims that are requested by the client during an authorization request. A claim is an IDaaS user attribute, for example, first name. The user attribute must be included if that claim is requested by the client during an authorization request. The required claims depend on the OIDC application that you are configuring on IDaaS.

   You can group claims, for example, the default claim, name, includes the user attribute First Name, a text-based value of a space and the user attribute value of Last Name so that the claim returned to the client is First Name <space> Last Name, for example Alice Gray.

3. To add a claim:

   1. Ensure that you have already created the required User Attributes in IDaaS (see Create and manage user attributes).

   2. Click . The Add Claim dialog box appears.

   3. In the Claim Name field, do one of the following:

      1. Select the Claim Name from the drop-down list.
      2. Type a Claim Name to create a new custom claim.

   4. In the Enter the Claim value expected by the Service Provider field, enter the following, as required:

      • User Attribute Value. An IDaaS user attribute (see Create and manage user attributes).
      • Text Based Value. A text based value. For example, to add a space between two claims or add text information.
      • Related Value. Include user group or authenticator attributes. See Configure OIDC claim to include user authenticators or groups.

      Example: some text <first Name> <Last Name> [Groups]

   5. Select Always Return with User Info to always return the user information with the claim.

   6. Select Always Return with ID Token to always return the ID Token with the claim.

   7. Click Add.

      info

      If required, click next to the claim and make the required changes. Click to delete a claim.

4. Click Save.

5. Proceed to Step 4: Configure customizations.

Step 4: Configure customizations

1. Click the Customization tab. The Customization page appears.
2. Deselect Enable Go Back Button if you do not want users to be able to go back to the application login page to log in.
3. Optional: Select Respond Immediately for Unsuccessful Responses to return to the application immediately after a login failure, rather than allow the user to try again with a different user ID.
4. Optional: Deselect Show Login Redirect URL in My Profile to hide the application from a user's profile.
5. Optional. Add a custom application logo, as follows:
   1. Click next to Application Logo. The Upload Logo dialog box appears.
   2. Click to select an image file to upload.
   3. Browse to select your file and click Open. The Upload Logo dialog box displays your selected image.
   4. If required, resize your image.
   5. Click OK.
6. Select the Login Options that appear to users during login. You must select at least one. For details on each login option and requirements, see Manage login options.
7. Click Save.
8. Proceed to Step 5: Add a resource rule.

Step 5: Add a resource rule

See Create resource rules.

Step 6: Optional. Add a resource server

1. Click the Resource Servers tab.
2. Click Add Resource Server.
3. Follow the instructions in Add an API/URL resource server.

Step 7: Modify the Auth. Provider settings in Salesforce

To complete this procedure, you need to have IDaaS open as you copy and paste information from IDaaS into Salesforce.

1. Log in to your Salesforce administrator account.

2. Click the cogwheel () and click Service Setup.

3. In the Navigation pane, click Identity > Auth Providers. The Auth Providers page appears.

4. Click New. The Auth. Provider Edit page appears.

5. From the Provider Type drop-down list, select Open ID Connect.

6. In the Name text box, enter IDaaS. The URL Suffix is auto-populated with the same value.

7. In IDaaS, go to > Resources > Applications. The Applications page appears.

8. Click Salesforce OIDC and click Next on the Edit Salesforce OIDC page. The Salesforce OIDC Settings page appears.

9. Copy the Client ID from the Salesforce OIDC settings in IDaaS and paste it in the Consumer Key text box on the Salesforce Auth. Provider page.

10. Copy the Client Secret value from the Salesforce OIDC settings in IDaaS and paste it in the Consumer Secret text box on the Salesforce Auth. Provider page.

11. In IDaaS, go to > Resources > Applications. The Applications page appears.

12. Click OIDC Configuration. The OIDC Configuration page appears.

13. Use the information on the IDaaS OIDC Configuration page as reference for the next steps.

14. On the Salesforce Auth. Provider page, enter the following:

    1. In the Authorize Endpoint URL text box, enter

       <IDaaS_account_URL>/api/oidc/authorize

    2. In the Token Endpoint URL text box, enter

       <IDaaS_account_URL>/api/oidc/token

    3. In the User info Endpoint URL text box, enter

       <IDaaS_account_URL>/api/oidc/userinfo

    4. In the Token Issuer text box, enter

       <IDaaS_account_URL>/api/oidc

    5. Optional: In the Custom Error URL text box, you can leave it blank or enter

       <IDaaS_account_URL>/api/oidc/errors

    6. Optional: In the Custom Logout URL text box, enter

       <IDaaS_account_URL>/api/oidc/endsession

       When set, the user is logged out of IDaaS when they log out of Salesforce. You can also leave this field blank.

       info

       This will not log you out of IDaaS when you log out of Salesforce but will redirect you back to IDaaS.

15. Check Send access token in header.

16. In the Default Scopes text box, enter openid email profile. (Do not include commas. The scopes must be entered separated by spaces.)

17. Select Send client credentials in header. This setting confirms that the client credentials are sent properly to the OIDC Provider.

18. Click Automatically create a registration handler template as the Registration Handler.

19. Click the Execute Registration search icon and select your Salesforce account user name.

20. Set an Icon URL, as follows:

    • Enter the URL of a custom icon.
    • Click Choose one of our sample icons and select an icon. A URL appears. Copy and paste that URL into the Icon URL text box.

21. Click Save. The Auth. Provider is created. The Salesforce Configuration details appears.

info

Leave this page open. You need to reference the Salesforce Configuration URLs in the next procedure, Step 8: Modify the Salesforce OIDC settings in IDaaS.

Step 8: Modify the Salesforce OIDC settings in IDaaS

1. You need to reference the Salesforce Auth. Provider settings to complete this procedure.

2. Log in to an IDaaS account with a role assigned that allows the configuration of applications on IDaaS.

3. Click > Resources > Applications. The Applications page appears.

4. Click the name of the Salesforce application you configured for OIDC and then click Next. The Settings page appears.

5. In the Initiate Logon URI text box, enter the Single Sign-On Initialization URL. The URL is listed in the Salesforce Configuration list on the Salesforce Auth Providers page.

6. In the Login Redirect URIs field, click , enter the Callback URL, and then click Add. The URL is listed in the Salesforce Configuration list on the Salesforce Auth Providers page.

   note

   The login redirect URI hostname is added as a valid CORS origin for OIDC processing.

7. Scroll down to the Registration Handler Script.

8. Click Copy To Clipboard to copy the registration handler script.

9. Return to the Auth. Provider page of your Salesforce account.

10. Click the Registration Handler link, for example, AutocreatedRegHandler12345678. The Apex Classes page appears with the Registration Handler code.

11. Click Edit.

12. Delete all of the code.

13. Paste the IDaaS Registration Handler Script that you copied to the clipboard in Step 8.

14. Click Save.

Step 9: Test the integration

Test the integration between your Salesforce and IDaaS accounts to confirm that your settings have been configured correctly.

1. Log in to your Salesforce administrator account.
2. Click Settings > Identity > Auth Providers. The Auth Providers page appears.
3. Click the name of your Auth. Provider configuration. The configuration settings appear.
4. Copy and paste the Test-Only Initialization URL into a new web browser address bar. You are directed to IDaaS for authentication if your settings are correct.
5. Enter the User ID of the IDaaS user that needs OIDC access, and click Next. IDaaS presents the challenge. By default, you are prompted to authenticate using your highest ranking active authenticator.
6. Respond to the authentication challenge.
7. Click Login if required. You are asked to allow access to the information included in the scopes or claims. You set these set the scopes when you configured IDaaS with Salesforce.
8. Click Allow. You can now access your Salesforce account through IDaaS.

Step 10: Add IDaaS to the Salesforce Logon page

1. Log in to your Salesforce administrator account.
2. In the navigation pane, go to Settings >My Company > My Domain. The My Domain page appears.
3. Under Authentication Configuration, click Edit and change the value entered in Your domain name to the domain name of your Salesforce account configured for IDaaS authentication.
4. Click Save.
5. Under Authentication Configuration, click Edit and select the name of your authentication service as an Authentication Service.
6. Deselect Login Page as an Authentication Service.
7. Click Save.
8. Test logging in to Salesforce from your IDaaS account to confirm that the configuration was successful.