> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Salesforce

A Salesforce account is automatically configured for single logout (SLO) when it is set up for Identity as a Service authentication. When the user logs out of a Salesforce account that is set up for Identity as a Service authentication, the user is also logged out of Identity as a Service. When the user logs out of Identity as a Service, the user is not automatically logged out of Salesforce.

You can also encrypt the assertions of this application.

note

Entrust recommends using a Federation ID for the User ID of your Salesforce account. Modify the Username at **Administration > Users > Users** in your Salesforce account. When adding Salesforce to Identity as a Service, define a User Attribute that maps to the user ID settings in your Salesforce configuration.

note

The instructions for this procedure apply to Salesforce accounts with the Lightning Experience user interface. You can follow the procedures if you have a Salesforce account with the classic user interface, but some of the steps may vary.

To integrate Salesforce with Identity as a Service you must do the following:

## Step 1: Create a custom user attribute for Salesforce

1. Click Menu icon **>** **Members > Attributes**. The **User Attributes List** page appears.
2. Under **Custom User Attributes**, click **Add**. The **Add User Attribute** dialog box appears.
3. Enter **Salesforce** as the **User Attribute Name** for the custom user attribute.
4. Check **Required** to make the user attribute mandatory.
5. Click **Add** to create the attribute. The attribute now appears in the list of **Custom User Attributes**.

## Step 2: Create a custom domain for Identity as a Service in Salesforce

1. Log in to your Salesforce administrator account.

2. In **Salesforce**, click the cogwheel and select **Setup**. The **Setup Home** navigation pane appears.

3. In the navigation pane, go to **Settings > Company Settings > My Domain**. The **My Domain** page appears.

4. In the **Domain Name** text box, enter a domain name.

note
If you cannot create a new domain name for your Salesforce URL, it is because you (or someone else) has already created a domain name for this account.

5. Click **Check Availability** to confirm the availability of the domain name.

6. After you find an available domain name, click **Register Domain**.

   You will receive a confirmation email when your domain is ready for testing.

## Step 3: Export a SAML signing certificate

1. Log in to your Identity as a Service administrator account.
2. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.
3. Under **SAML Cloud Integrations**, click **SAML Signing Certificates**. The **SAML** **Signing Certificates** page appears.
4. Click **Download** next to the certificate to export the certificate you want to import into your SAML service provider application. The **Export Certificate** dialog box appears.
5. If the certificate has been issued by a CA, do one of the following:
   - Click **Certificate** to export the self-signed certificate.
   - Click **Root CA Certificate** to export a certificate issued from a CA.
   - Click **Certificate Chain** to export the SAML signing certificate and its CA certificates.
6. Click **Export**.

## Step 4: Modify Salesforce settings to support encryption

1. Log in to your Salesforce administrator account.

2. Go to **Settings > Security > Certificate and Key Management**. The **Certificate and Key Management** page appears.

3. Click **Create Self-Signed Certificate**. The **Certificates** page appears.

4. Enter a **Label** for your Salesforce certificate.

5. Enter a **Unique Name**.

6. Click **Save**. You are returned to the **Certificates** page.

   The newly-created certificate appears in the **Certificates** list.

7. Click the new Certificate. The **Certificate and Key Details** appear.

8. Click **Download Certificate**. The certificate is downloaded to your computer.

## Step 5: Configure Salesforce for SSO

1. In your Salesforce administrator account, go to **Settings > Identity > Single Sign-On Settings**. The **Single Sign-On Settings** page appears.

2. Under **SAML Single Sign-On Settings**, click **New**. The **SAML Single Sign-On Settings** page appears.

3. In the **Name** and **API Name** text box, enter the Domain Name you created in _Step 1: Create a custom domain_.

4. In the **Issuer** text box, enter the URL of your Identity as a Service account, followed by `/api/saml`

   Example: `https://example.us.trustedauth.com/api/saml`

5. In the **Entity ID** text box, enter `https://<domain name>` where domain name is your Salesforce account domain name.

   Example: `https://example.my.salesforce.com`

6. In the **Identity Provider Certificate** field, browse to upload the signing certificate you downloaded from Identity as a Service in _Step 2: Download the Signing Certificate_.

7. From the **Request Signing Certificate** drop-down list, select the certificate you created in _Step 3: Modify Salesforce to Support Encryption_.

8. From the **Request Signature Method** drop-down list, select **RSA SHA256**.

9. From the **Assertion Decryption Certificate** drop-down list, select the certificate you created in _Step 3: Modify Salesforce to Support Encryption_.

10. Select the **SAML Identity Type** that you want use to authenticate from Identity as a Service to Salesforce. This is the method used to redirect Salesforce users to Identity as a Service for authentication. Select the assertion to contain one of the following:

    - Select **Assertion contains the User's Salesforce username** to redirect a user to Identity as a Service based on the Salesforce attribute in Identity as a Service.
    - Select **Assertion contains the Federation ID from the User Object** to redirect a user to Identity as a Service based on their Federation ID.

11. For the **SAML Identity Location**, select **Identity is in the NameIdentifier element of the Subject statement**.

12. For the **Service Provider Initiated Request Binding**, select **HTTP Redirect** **or** **HTTP POST**.

13. In the **Identity Provider Login URL** text box, enter the URL of your Identity as a Service account, followed by `/api/saml/SAML2/SSO`

    Example: `https://example.us.trustedauth.com/api/saml/SAML2/SSO`

14. In the **Custom Logout URL** text box, enter `https://<domain>/api/saml/SAML2/SLO` where domain is your Salesforce account.

    Example: `https://example.us.trustedauth.com/api/saml/SAML2/SLO`

    Setting the Custom Logout URL causes the user to log out of their Identity as a Service account when they log out of Salesforce.

15. Leave the **Custom Error URL** blank.

16. Confirm that **Single Logout Enabled and Just-in-time User Provisioning** are not selected.

17. Click **Save**. The settings are saved and the **Endpoints** appear on the Single Sign-On Settings page.

18. Record the **Login URL** and **Logout URL** in a separate location. You need to enter both of these URLs when you complete _Step 5: Add Salesforce to Identity as a Service_.

19. Under **Settings > Identity**, click **Single Sign-On Settings** to refresh the Single Sign-On Settings page.

20. Above **Federated Single Sign-On Using SAML**, click **Edit**.

21. Select **SAML Enabled** to enable Federated SSO.

22. Click **Save**.

## Step 6: Complete based on your SAML Identity Type selection

### If you selected Assertion contains the Federation ID from the User Object

1. In your Salesforce administrator account, go to **Administration > Users > Users**. The **All Users** page appears.
2. Click the user name. The **User Detail** page appears.
3. Click **Edit**. the **General Information** page appear.
4. Under **Single Sign On Information**, enter a value for the **Federation ID** that corresponds to the Identity as a Service user attribute you created in _Step 1: Create a custom user attribute for Salesforce_.
5. Click **Save**.

### If you selected Assertion contains the User's Salesforce username

1. In your Salesforce administrator account, go to **Settings > Company Settings > My Domain**. The **My Domain** page appears.
2. Scroll to the **Authentication Configuration** section and click **Edit**. The **Authentication Configuration** page appears.
3. Under **Authentication Service**, do the following to have your Salesforce users redirected automatically to Identity as a Service for authentication:
   1. Deselect **Login Page**.
   2. Select your SAML configuration.
   3. Click **Save** to return to the My Domain page.
4. Deploy the configuration to users, as follows:
   1. Click **Deploy to Users**. Click **OK** on the warning message.

   2. Click **Edit** in the **My Domain Settings** section of the **My Domain** page.

   3. Select **Prevent login from <https://login.salesforce.com>**.

   4. Click **Save**.

      The **My Domain Settings** shows that the **Login Policy** is enabled to prevent users from logging into Salesforce directly.

## Step 7: Add Salesforce to Identity as a Service

1. Log in to your Identity as a Service administrator account.

2. Click Menu icon **>** **Security > Applications**. The **Applications** **Lists** page appears.

3. Click **Add**. The **Select an Application Template** page appears.

4. Do one of the following:

   - Select **SAML Cloud Integrations** from the search drop-down list and scroll to find the application you want to add to IDaaS.
   - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS.

5. Click **Salesforce**. The **Add Salesforce** page appears.

6. Enter an **Application Name**.

7. Enter an **Application Description**.

8. Optional. Add a custom application logo.

   1. Click Plus icon next to **Application Logo**. The **Upload Logo** dialog box appears.
   2. Click Upload icon to select an image file to upload.
   3. Browse to select your file and click **Open**. The **Upload Logo** dialog box reappears showing your selected image.
   4. If required, resize your image.
   5. Click **OK**.

9. Select the **Authentication Flow** that appears to users during login.

10. Click **Next**. The **General** setup page appears.

11. If available, use the **Upload Metadata XML** file option to auto-populate the following fields, if available in the file:

    - Default Assertion Consumer Service URL
    - Alternative Assertion Consumer URLs
    - Service Provider Entity ID (Issuer)
    - Single Logout Service URL
    - SAML Signing Certificate
    - SAML NameID Encoding Format
    - SAML Signature Algorithm
    1. Click **Upload** to the **Upload Metadata XML** and browse to the location of the metadata file you downloaded. The **Metadata Configuration** dialog box appears.
    2. If required, click **Merge with existing values** to merge new values with existing values for Alternative Assertion Consumer Services URLs and SAML attribute names.
    3. Click **Save**.

12. If you do not have a metadata file, use the information provided in the next steps to populate the fields.

13. Enter the **Default Assertion Consumer Service URL**.

    The SAML Assertion Consumer Service URL is the URL used by Identity as a Service to assert authentication to an application. In Salesforce, this is the **Salesforce Login URL** provided on the **SAML Single Sign-On Settings** of your Salesforce account. You made note of this URL in _Step 4: Configure Salesforce for SSO_.

14. Enter the **Service Provider Entity ID (Issuer)**, which is used by Identity as a Service to identify the application. The entity URL must be unique and in standard URI format.

tip
In your Salesforce administrator account, go to **Settings > Identity > Single Sign-On Settings**. Your Entity ID is shown on the **Single Sign-On Settings** page.

15. Enter the **SAML Session Timeout** to the time when the SAML Assertion times out. The maximum is 720 minutes.

16. Enter the **Max Authentication Age (seconds)** to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IDP-initiated login. Set this field to -1 to disable this feature.

17. From the **SAML NameID Attribute**, select the following:

    - The **SAML NameID Attribute** must contain a user name if **Username** was selected as the **SAML Identity Type** in _Step 4: Configure Salesforce for SSO_.
    - The **SAML NameID Attribute** must contain a Federation ID if **Federation ID** was selected as the **SAML Identity Type** in _Step 4: Configure Salesforce for SSO_.
    - The user attribute value selected as the **SAML NameID Attribute** must contain a user name or Federation ID that already exists in your Salesforce account.

attention
Make sure that the **SAML NameID Attribute** you select corresponds to a **Username** or **Federation ID** already registered in your Salesforce account. Check that the spelling and case of every character of the **SAML NameID Attribute** is an exact match. If one letter is entered incorrectly, the user will not be able to log into the application. If a user does not enter a user name or Federation ID registered on the Salesforce account, authentication to the applications fails. You can add an additional user attribute containing a valid user name or Federation ID.

18. Leave the **Single Logout Service URL** field blank.

note
Users that log out from Salesforce are redirected to the Identity as a Service login page.

19. Optional. Enter the **SAML Username Parameter Name** used to identity the user ID being requested for authentication. The user ID can then be passed as a parameter, for example, Username=jdoe. Alternately, if the SAML username is NameID, the SAML Request XML NameID element value is used to the identify the IDaaS userID.

20. Select the **SAML NameID Encoding Format** from the drop-down list.

note
Make sure that the **SAML NameID** encoding format corresponds with the type of **SAML NameID Attribute** you have selected. If the attribute contains an email address, select **Email_ID**. If it contains a standard username or Federation ID, select **Unspecified** or **Persistent**.

21. Select the **SAML Signing Certificate** from the drop-down list.

22. From the **SAML Response Signature Algorithm** drop-down list, select the type of signing algorithm used by Identity as a Service to sign the SAML response.

23. Optional: Select **Sign complete SAML response** to ensure the message integrity of the SAML response sent to Salesforce during authentication.

24. Deselect **Enable Go Back Button** if you do not want users to be able to go back to the Salesforce login page to log in.

25. Select **Show Default Assertion Consumer URL Service in the My Profile**. When selected, the Default Assertion Consumer URL appears in a user's My Profile page in addition to relay states and Alternative Assertion Consumer URLs.

26. Optional. Select **Encrypt SAML Assertion** to secure communications between Identity as a Service and Salesforce.

    1. From the **Encryption Method for Key** drop-down list, select either **RSA Version 1.5** or **RSA-OAEP**. RSA Version 1.5 is the default.

    2. From the **Encryption Method for Data** drop-down list, select the encryption method used to encrypt data.

    3. In the **Encryption Certificate** field, upload the encryption certificate file you downloaded in _Step 3:Modify Salesforce account settings to support encryption_.

    note
    The **Subject Domain Name** and **Certificate Expiry Date** values are populated with values from the certificate once the **Encryption Certificate** is uploaded.

27. Optional. Add **Alternative Assertion Consumer Service URLs**, as follows:

    1. Click **Add**.
    2. Enter a **Name**.
    3. Enter a URL **Value**.
    4. Select **Show in My Profile** to display the Alternative Consumer Service URL in a user's My profile page.
    5. Click **Add**.
    6. Repeat these steps to add more Alternative Assertion Consumer Service URLs.

28. Optional. Add a **Relay State** as follows:

    1. Under Relay State, click **Add**. The **Add Relay State** dialog box appears.

    2. Enter a **Name** for the relay state.

    3. Enter the **Value** for the relay state. This setting specifies the application or URL that is a user is redirected to after successful authentication.

    4. Select **Show in My Profile** to display the relay state on the user's My Profile page.

    note
    After you add relay states, you can also enable or disable them on the Add/Edit application page. Relay states apply to the Default Assertion Consumer Service URLs and not the Alternative Assertion Consumers URLs.

    5. Optional. Add a Relay State custom logo.

       1. Click Plus icon next to **Relay State Logo**. The **Upload Logo** dialog box appears.
       2. Click Upload icon to select an image file to upload.
       3. Browse to select your file and click **Open**. The **Upload Logo** dialog box reappears showing your selected image.
       4. If required, resize your image.
       5. Click **OK**.

    6. Click **Add**.

    7. Repeat these steps to add more Relay States.

29. Click **Submit**.

## Step 8: Add a resource rule

See [Create resource rules](/docs/authentication-and-security/create-and-manage-resource-rules.md).