Salesforce

Introduction

You have to configure both Salesforce and Trustelem so as to align single sign-on parameters.

Access to Salesforce parameters

Login as administrator to https://login.salesforce.com

In section « Administer », click on « Security Controls »

Click on « Configure single-sign on for your organization »

Trustelem Configuration

Select a certificate for this application

Choose to enable or disable automatic user provisioning

In the Salesforce administration console, find the parameter named « Salesforce Login URL » (starting with https://login.salesforce.com/?saml=<...>), and paste its value in the corresponding Trustelem field

Get the ProfileID corresponding the to profile that will be given to users created by automatic provisioning: open the profile details in the Salesforce console, the ProfileID is in the URL

Paste this value in the field named « User creation ProfileID » in Trustelem

Nota: Salesforce also allows to use directly the Profile name instead of its ID

Salesforce Configuration

On Salesforce single sign-on parameters panel, click on button « Edit »

In section « Federated Single Sign-On Using SAML »:

Check option « SAML Enabled »

Check option « User Provisioning Enabled »

For parameter « SAML Version », select « 2.0 »

For parameter « Issuer », input:

https://mydomain.trustelem.com/app/17XXX

Download the certificate from Trustelem (.pem file) and select it as parameter « Identity Provider Certificate »

For parameter « Identity Provider Login URL », input:

https://mydomain.trustelem.com/app/17XXX/sso

For parameter « Identity Provider Logout URL », input:

https://mydomain.trustelem.com/app/17XXX/slo

Let parameter « Custom Error URL » empty

For parameter « SAML Identity Type », choose « Assertion contains the Federation ID from the User object »

For parameter « SAML Identity Location », choose « Identity is in the NameIdentifier element of the Subject statement »

For parameter « Entity ID », choose « https//saml.salesforce.com »

For parameter « Service Provider Initiated Request Binding », choose « HTTP Redirect »

Click on button « Save »