Steps to integrate the SSO between Salesforce (as SP) and
OAM 11g R2 PS2 ( 11.1.2.2.0) Protected applications (IdP):
Tested on OAM 11g R2 PS2 and Salesforce cloud application.
This post explains the steps involved in integrating Salesforce with OAM 11g R2 PS2 where OAM is acting as Identity Provider(IdP) and Salesforce application is a Service Provide (SP)
1)
Create a new developer sandbox and publish it as
domain.
It should have a URL similar to below URL:
2)
Go to Identity Provider Administrator in OAM as
shown below and create SP attribute profile as shown below for mail.
a) Click Identity Provider Administrator
b) Click Service Provider Attribute Profile
c) Edit the sp-attribute-profile to have IDPEmail
as user.attr.mail as shown below
Go to
{oam_host}:{oam_port}/oamfed/idp/metadata
Locate
the "<md:KeyDescriptor use="signing">" tag
Copy
the contents of the "<dsig:X509Certificate>" tag and save it
using a text editor as a .cer file
Import
this cer file as the Identity Provider Certificate
Note:
If Salesforce complains about an error in the certificate, just double-click on
the .cer file you saved from the above step, click on the details tab and 'Copy
to file' and save as DER format
SALESFORCE SIDE CONFIGURATIONS:
4)
Login to salesforce as Admin-> Security
Controls->Single Sign On Settings
·
Enable the SAML
5) Create new SAML Single Sign On Settings as shown below:
6)
Download the metadata and store it in your local
system
7)
Go back to OAM Identity Provider Administrations:
·
Create a new SP profile by loading metadata
downloaded from Salesforce site.
8)
The SP initiated login is enforced using the
below setting:
9)
Try accessing below URL for IdP initiated Login:
10)
Try access below URL for SP initiated Login:
Thanks,
Feel free to contact me for any issue/suggestions @ abhishek.nitc@gmail.com
