Federated SSO between Salesforce (as SP) and OAM 11g R2 PS2 Protected applications (IdP)

Steps to integrate the SSO between Salesforce (as SP) and OAM 11g R2 PS2 ( 11.1.2.2.0) Protected applications (IdP):

Tested on OAM 11g R2 PS2 and Salesforce cloud application.

This post explains the steps involved in integrating Salesforce with OAM 11g R2 PS2 where OAM is acting as Identity Provider(IdP) and Salesforce application is a Service Provide (SP)

1)      Create a new developer sandbox and publish it as domain.

It should have a URL similar to below URL:

https://abhishek<<company>>-dev-ed.my.salesforce.com

2)      Go to Identity Provider Administrator in OAM as shown below and create SP attribute profile as shown below for mail.

a)      Click Identity Provider Administrator

       b)  Click Service Provider Attribute Profile

       c) Edit the sp-attribute-profile to have IDPEmail as user.attr.mail as shown below

3)      http://<<oamhostname>>.<<company>>.com:14100/oamfed/idp/metadata

Go to {oam_host}:{oam_port}/oamfed/idp/metadata

Locate the "<md:KeyDescriptor use="signing">" tag

Copy the contents of the "<dsig:X509Certificate>" tag and save it using a text editor as a .cer file

Import this cer file as the Identity Provider Certificate

Note: If Salesforce complains about an error in the certificate, just double-click on the .cer file you saved from the above step, click on the details tab and 'Copy to file' and save as DER format

SALESFORCE SIDE CONFIGURATIONS:

4)      Login to salesforce as Admin-> Security Controls->Single Sign On Settings

·         Enable the SAML

5)      Create new SAML Single Sign On Settings as shown below:

6)      Download the metadata and store it in your local system

7)      Go back to OAM Identity Provider Administrations:

·         Create a new SP profile by loading metadata downloaded from Salesforce site.

8)      The SP initiated login is enforced using the below setting:

9)      Try accessing below URL for IdP initiated Login:

http://<<oamhostname>>.<<company>>.com:14100/oamfed/idp/initiatesso?providerid=OAMIdP&returnurl=https://abhishek<<company>>-dev-ed.my.salesforce.com

10)      Try access below URL for SP initiated Login:

https://abhishek<<company>>-dev-ed.my.salesforce.com

Thanks,

Feel free to contact me for any issue/suggestions @ abhishek.nitc@gmail.com