Okta

How to Configure SAML 2.0 for Salesforce Federated ID

 

Read this before you enable SAML

Please turn on Provisioning for Salesforce Federated ID App in Okta. If Provisioning is not turned on for this app, users will not be authenticated in to Salesforce. 

CLICK HERE to log in to Salesforce with the your administrator username and password-token.

  1. Click on Setup.

  2. Click Security Controls to open the sub-menu.

  3. Click Single Sign-On Settings.
    sf1.png

  4. Check the Checkbox for SAML Enabled.
  5. If you have Multiple End-points enabled, the configuration page may ask you to setup a Name and API Name. Set these values according to your preference.
  6. Copy and paste the following value into the Issuer field:

    Sign in to the Okta Admin app to have this variable generated for you.
  7. Download your Okta Identity Provider Certificate, and then upload it in the Identity Provider Certificate field:

    Sign in to the Okta Admin app to have this variable generated for you.
  8. For SAML Identity Type, select Assertion contains the Federation ID from the User object.
  9. For SAML Identity Location, select Identity is in the NameIdentifier element of the Subject Statement.
  10. (Optional) Copy and paste the following URL into Identity Provider Login URL:

    Sign in to the Okta Admin app to have this variable generated for you.
  11. (Optional) Copy and paste the following URL into Identity Provider Logout URL:

    Sign in to the Okta Admin app to have this variable generated for you.
  12. For Entity ID, 
    • If you have a custom domain setup, use https://<customDomain>.my.salesforce.com.
    • If you do not have a custom domain setup, use https://saml.salesforce.com.

     

  13. For Service Provider Initiated Request Binding, select HTTP Post.

  14. Click Save. 

  15. Copy the Salesforce Login URL which will appear after clicking Save.
    Screen_Shot_2013-11-08_at_5.09.08_PM.png
  16. In Okta, go to the Sign On Tab of app configuration shown in the image below. Select YES for the Use Fed ID for SAML 

    sfdc_new.png
  17. In Okta, paste the Salesforce Login URl you copied in Step 15 to the Login URl field. If you have Login URL field configured, you will always be redirected to it.
  18. In Okta, for Custom Salesforce domain: If you have a Custom Salesforce Domain, such as site-name.my.salesforce.com, enter site-name, otherwise leave blank. (Hint: If your Salesforce Login URL starts with https://login.salesforce.com, then leave this field blank.)
  19. Click Save.
  20. Done!