Configuration Guides

Configuring SAML SSO with Salesforce and PingFederate

Enable Salesforce sign-on from a PingFederate URL (IdP-initiated sign-on) plus single logout (SLO).

Before you begin

  • Configure PingFederate to authenticate against an IdP or datastore containing the users requiring application access.

  • Populate Salesforce with at least one user to test access.

  • You must have administrative access to PingFederate and Salesforce.

Create a PingFederate SP connection for Salesforce

  1. Sign on to the PingFederate administrative console.

  2. Create an SP connection for Salesforce in PingFederate:

    1. Configure using Browser SSO profile SAML 2.0.

    2. Set Partner’s Entity ID to Entity ID.

      • Enable the following SAML Profiles:

      • IDP-Initiated SSO

      • SP Initiated SSO

      • IDP-Initiated SLO

      • SP Initiated SLO

    3. In Assertion Creation → Authentication Source Mapping → Attribute Contract Fulfillment, map the SAML_SUBJECT to the attribute containing the Salesforce username.

    4. In Protocol Settings → Assertion Consumer Service URL, set Binding to POST and set Endpoint URL to ACS URL.

    5. In Protocol Settings → SLO Service URLs, set Binding to POST and set Endpoint URL to SLO URL.

    6. In Protocol Settings → Allowable SAML Bindings, enable POST.

    7. In Credentials → Digital Signature Settings, select the PingFederate Signing Certificate.

    8. In Credentials → Signature Verification, set Trust Model to Unanchored.

    9. In Credentials → Signature Verification → Signature Verification Certificate, select the PingFederate Signing Certificate.

      This certificate is a placeholder and will be replaced with a Salesforce certificate.

  3. Export the metadata for the newly created Salesforce SP connection.

  4. Export the signing certificate.

Add the PingFederate IDP Connection to Salesforce

  1. Sign on to your Salesforce domain as an administrator.

  2. Click the Gear icon, then go to Setup → Identity → Single Sign-On Settings.

    Screen capture of the Salesforce Single Sign-On Settings.

  3. On the Single Sign-On Settings page, click Edit.

    Screen capture of the Salesforce Single Sign-On Settings with the Edit button highlighted in red.

  4. Select the SAML Enabled check box to enable the use of SAML single sign-on. Click Save.

    Screen capture of the Salesforce Single Sign-On Settings with the SAML enabled checkbox and the Save button highlighted in red.

  5. Click New From Metadata File.

    Screen capture of the Salesforce SAML Single Sign-On Settings section with the New from Metadata File button highlighted in red.

  6. Click Choose File, select the metadata that you downloaded from PingFederate, and click Create.

    Screen capture of the Salesforce SAML Single Sign-On Settings with the Choose File and the Create buttons highlighted in red.

    The summary screen opens.

  7. In the Identity Provider Certificate section, click Choose file and select the signing certificate that you downloaded from PingFederate.

  8. Clear the Single Logout Enabled check box if you don’t require single logout.

    The summary page opens.

    Screen capture of the SAML Single Sign-On Settings with the Save button highlighted in red.

  9. Click Save.

  10. On the summary page for the configuration that you saved in the previous step, click Edit.

    Screen capture of the SAML Single Sign-On Settings with the Edit button highlighted in red.

  11. Click the link on the Request Signing Certificate line.

    Screen capture of the Identity Provider Certificate, the Request Signing Certificate, and the Request Signature Method fields with the Request Signing Certificate field highlighted in red.

  12. Click Download Certificate.

    Screen capture of the Certificates section with the Download Certificate button highlighted in red.

Import the Salesforce certificate into PingFederate

  1. Sign on to the PingFederate administrative console.

  2. Open the Salesforce SP connection and click Signature Verification Certificate.

  3. Delete the placeholder certificate and upload the certificate that you downloaded from Salesforce.

  4. Save the configuration.

Test the PingFederate IdP-initiated SSO integration

  1. Go to the PingFederate SSO application endpoint for the Salesforce SP connection.

  2. Complete PingFederate authentication.

    You’re redirected to your Salesforce domain.

    Screen capture of the Salesforce doman home page.

Configure direct Salesforce sign-on using PingFederate (SP-initiated sign-on) plus single logout (SLO)

Before you begin

  • You must first enable IdP-initiated sign-on.

Enable PingFederate authentication in Salesforce

  1. Sign on to your Salesforce domain as an administrator.

  2. Click the Gear icon, then go to Setup → Company Settings → My Domain.

    Screen capture of the Salesforce Settings menu with the My Domain tab highlighted.

  3. Make a note of your domain name, such as https://your-company.my.salesforce.com.

  4. In the Authentication Configuration section, click Edit.

    Screen capture of the Salesforce Authentication Configuration page with the Edit button highlighted in red.

  5. In the Authentication Service list, select YourPingFederate. Click Save.

    Screen capture of the Salesforce Authentication Configuration page with the Save and YourPingFederate check box highlighted in red.

    The "YourPingFederate" entry was created as a result of the IdP-initiated login tasks above.

    Configuration is complete.

Salesforce will now redirect to PingFederate for authentication of all new sessions.

You should also select the Login Form check box during the testing phase in case of authentication issues. Testers will be offered the option of the standard Salesforce login form or PingFederate authentication. After you’ve successfully tested authentication against PingFederate, you can clear the Login Form check box so that authentication automatically defaults to PingFederate.

Test the PingFederate SP-initiated SSO integration

  1. Go to your Salesforce domain.

    If the Login Form check box is still selected, the Salesforce sign on screen still displays, and you’re offered a choice of Salesforce sign on or PingFederate sign on, select PingFederate.

    If you’ve cleared the Login Form check box, you’re not offered a choice.

  2. When you are redirected to PingFederate, enter your PingFederate username and password.

    After successful authentication, you’re redirected back to Salesforce.

    Screen capture of the Salesforce home page.