Integrate Salesforce OIDC with Identity as a Service

For this integration, you must ensure that the email system user attribute is set to mandatory.

 

 

1.      Log in to Identity as a Service.

2.      Click > Security > Applications. The Applications List page appears.

3.      Click Add. The Select an Application Template page appears.

4.      Do one of the following:

●       Select OpenID Connect and OAuth Cloud Integrations from the search drop-down list and scroll to find the application you want to add to IDaaS.

- or -

●       In the Search bar, enter a search option to filter for the application you want to add to IDaaS.

5.      Click Salesforce OIDC. The Add Salesforce OIDC page appears.

6.      Modify the Application Name and Application Description, if required.

7.      Optional. Add a custom application logo, as follows:

a.      Click next to Application Logo. The Upload Logo dialog box appears.

b.      Click to select an image file to upload.

c.      Browse to select your file and click Open. The Upload Logo dialog box reappears showing your selected image.

d.      If required, resize your image.

e.      Click OK.

8.      Select the Authentication Flow that appears to users during login.

9.      Click Next. The General Settings and Authentication Settings page appears.

10.  In the General Settings, do the following:

Attention: Identity as a Service generates the Client ID, Client Secret, and Registration Handler Script automatically. You will copy and paste these values into the required settings of your Salesforce OIDC application account in Step 4:Modify the Auth. Provider settings in Salesforce.

a.      Select the OIDC Signing Certificate used to connect to the Salesforce OIDC.

b.      Optional: Deselect Show Login Redirect URL in My Profile to hide the application from a user's profile.

c.      Click Add next to Login Redirect URIs.

d.      In the Add Login Redirect URI field, enter  https://todo.com and then click OK.

e.      Deselect Enable Go Back Button if you do not want users to be able to go back to the Salesforce OIDC login page to log in.

f.        Accept the defaults for the remaining General Settings.

11.  In the Authentication Settings, do the following:

a.      Select Require Content to require that users respond to a consent prompt for each request.

b.      Optional. Enter a Consent Message to include a message to users when consent is requested.

c.      Set Max Authentication Age (seconds) to the maximum amount of time that can elapse before a user must re-authenticate to log in. This feature is disabled if the field is left blank.

d.      Under Grant Types, select Authorization Code. The Grant Type tells Identity as a Service what flow to use for returning authorization responses.

e.       From the  Authorization Code PKCE Code Challenge Method drop-down list, select None as  the method used with PKCE during authentication.

f.        Select Include Authentication Time to include the authentication time for all tokens.

g.      From the ID Token Signing Algorithm drop-down list, select RS256 as the signing algorithm used to sign with ID Token during authentication.

h.      From the User Info Signing Algorithm, select none.

12.  The authorization request uses Supported Scopes to establish a connection between Identity as a Service and the Salesforce OIDC application. Supported Scopes are selected by default. If you disable Your unique identifier, the Salesforce OIDC application strictly uses an access token to access a resource server API on behalf of a user.

Note: Click the arrow next to each scope to see the list of Implied Claims included in the scope. The list of Implied Claims is defined by OpenID Connect and cannot be modified. Every Implied Claim included in the scopes you select under Supported Scopes should have an associated Identity as a Service user attribute so that the attribute is returned as part of the OIDC tokens sent back to the client. For example, if you select Address as a Supported Scope, then you must define an Identity as a Service user attribute for each Implied Claim associated with Address. See Create and manage user attributes.

13.  Do not modify any of the Supported Claims selected settings.

14.  Copy the Registration Handler Script.

15.  Click Submit. A success message appears.

16.  Make note of the Client ID value. You enter this value as the Consumer Key during Step 4: Modify the Auth Provider Settings in Salesforce.

17.  Click Submit.

Note: To use this configuration, the email system user attribute must be configured as mandatory. See Create custom user attributes  for more information.

To complete this procedure, you need to have Identity as a Service open as you copy and paste information from Identity as a Service into Salesforce.

1.      Log in to your Salesforce administrator account.

2.      Click the cogwheel () and click Service Setup.

3.      In the Navigation pane, click Identity > Auth Providers.  The Auth Providers page appears.

4.      Click New. The Auth. Provider Edit page appears.

5.       From the Provider Type drop-down list, select Open ID Connect.

6.      In the Name text box, enter Identity as a Service. The URL Suffix is auto-populated with the same value.

7.      In Identity as a Service, go to > Resources > Applications. The Applications page appears.

8.      Click Salesforce OIDC and click Next on the Edit Salesforce OIDC page. The Salesforce OIDC Settings page appears.

9.      Copy the Client ID from the Salesforce OIDC settings in Identity as a Service and paste it in the Consumer Key text box on the Salesforce Auth. Provider page.

10.  Copy the Client Secret value from the Salesforce OIDC settings in Identity as a Service and paste it in the Consumer Secret test box on the Salesforce  Auth. Provider page.

11.  In Identity as a Service, go to > Resources > Applications. The Applications page appears.

12.  Click OIDC Configuration. The OIDC Configuration page appears.

13.  Use the information on the Identity as a Service OIDC Configuration page as reference for the next steps.

14.  On the Salesforce  Auth. Provider page, enter the following:

a.      In the Authorize Endpoint URL text box, enter

<Identity as a Service_account_url>/api/oidc/authorize

b.      In the Token Endpoint URL text box, enter

<Identity as a Service_account_URL>/api/oidc/token

c.      In the User info Endpoint URL text box, enter

<Identity as a Service_account_URL>/api/oidc/userinfo

d.      In the Token Issuer text box, enter

 <Identity as a Service_account_URL>/api/oidc

e.      Optional: In the Custom Error URL text box, you can leave it blank or enter

<Identity as a Service_account_URL>/api/oidc/errors

f.        Optional: In the Custom Logout URL text box, enter

<Identity as a Service_account_URL>/api/oidc/endsession

When set, the user is logged out of Identity as a Service when they log out of Salesforce. You can also leave this field blank.

Note: The URL of your Identity as a Service account can also be entered as the Custom Logout URL. This will not log you out of Identity as a Service when you log out of Salesforce but will redirect you back to Identity as a Service.

15.  Check Send access token in header.

16.  In the Default Scopes text box, enter openid email profile. (Do not include commas. The scopes must be entered separated by spaces.)

17.  Select Send client credentials in header. This setting confirms that the client credentials are sent properly to the OIDC Provider.

18.  Click Automatically create a registration handler template as the Registration Handler.

19.  Click the Execute Registration search icon and select your Salesforce account user name.

20.  Set an Icon URL, as follows:

●       Enter the URL of a custom icon.

-or-

●       Click Choose one of our sample icons and select an icon. A URL appears. Copy and paste that URL into the Icon URL text box.

21.  Click Save. The Auth. Provider is created. The Salesforce Configuration details appears.

Attention: Leave this page open. You need to reference the Salesforce Configuration URLs in the next procedure, Step 5: Modify Salesforce OIDC applications settings in Identity as a Service.

You need to reference the Salesforce Auth. Provider settings to complete this procedure.

1.      Log in to an Identity as a Service account with a role assigned that allows the configuration of applications on Identity as a Service.

2.      Click > Resources > Applications. The Applications page appears.

3.      Click the name of the Salesforce application you configured for OIDC and then click Next. The Settings page appears.

4.      In the Initiate Logon URI text box, enter the Single Sign-On Initialization URL. The URL is listed in the Salesforce Configuration list on the Salesforce Auth Providers page.

5.      In the Login Redirect URIs field, click , enter the Callback URL, and then click Add. The URL is listed in the Salesforce Configuration list on the Salesforce Auth Providers page.

Note: The login redirect URI hostname is added as a valid CORS origin for OIDC processing.

6.      Scroll down to the Registration Handler Script.

7.      Click Copy To Clipboard to copy the registration handler script.

8.      Return to the Auth. Provider page of your Salesforce account.

9.      Click the Registration Handler link, for example, AutocreatedRegHandler12345678. The Apex Classes page appears with the Registration Handler code.

10.  Click Edit.

11.  Delete all of the code.

12.  Paste the Identity as a Service Registration Handler Script that you copied to the clipboard in Step 7.

13.  Click Save.

Test the integration between your Salesforce and Identity as a Service accounts to confirm that your settings have been configured correctly.

1.      Log in to your Salesforce administrator account. 

2.      Click Settings > Identity > Auth Providers.  The Auth Providers page appears.

3.      Click the name of your Auth. Provider configuration. The configuration settings appear.

4.      Copy and paste the Test-Only Initialization URL into a new Web browser address bar. You are directed to Identity as a Service for authentication if your settings.

5.      Enter the User ID of the Identity as a Service user that needs OIDC access, and click Next. Identity as a Service presents the challenge. By default, you are prompted to authenticate using your highest ranking active authenticator.

6.      Respond to the authentication challenge.

7.      Click Login if required. You are asked to allow access to the information included in the scopes or claims. You set these set the scopes when you configured Identity as a Service with Salesforce.

8.      Click Allow. You can now access your Salesforce account through Identity as a Service.

1.      Log in to your Salesforce administrator account.

2.      In the navigation pane, go to Settings >My Company > My Domain. The My Domain page appears.

3.      Under Authentication Configuration, click Edit and change the value entered in Your domain name to the domain name of your Salesforce account configured for Identity as a Service authentication.

4.      Click Save.

5.      Under Authentication Configuration, click Edit and select the name of the your authentication service as an Authentication Service.

6.      Deselect Login Page as an Authentication Service.

7.      Click Save.

8.      Test logging in to Salesforce from your Identity as a Service account to confirm that the configuration was successful.