Configuring Single Sign-On using ADFS 3.0

This section provide information about configuring Single Sign-On using ADFS 3.0. For more information, refer following sections:

Prerequisites

Before you start configuring ADFS and Salesforce for Single Sign-On, you must address the following prerequisites:

Install Microsoft Windows 2008 R2
Install Microsoft Active Directory
Installing Microsoft Certificate Server and IIS
Install Microsoft Active Directory Federations Services 3.0 or later versions
Create and Configure a Server Authentication Certificate in IIS

Click Single Sign-On, Active Directory, and Salesforce to know the details about prerequisites.

To install a certificate

Perform the following steps if Token-signing certificate has expired in ADFS server.

In ADFS, expand Service and click Certificates.
Double click the certificate listed under Token-signing.
If the CA Root certificate is not trusted, it’ll look as follows.
Click Install Certificate.
Select Local Machine.
On Certificate Import Wizard, click Next.
Select Place all certificates in the following store and click Browse.
In the Select Certificate Store window, select Trusted Root Certification Authorities and click OK.
Click Next.
Click Finish.
When the Security Warning dialog box is displayed to install the certificate, click Yes.
Click OK on the message indicating that the import was successful.
Click OK and close the Certificate dialog.
Double click on the certificate listed under Token-signing. The certificate should now be trusted.
Click on the Details tab and then click Copy to File.
Specify a filename and a directory where the file should be created.
Click Next.
Click Finish.
Click OK on the dialog box that is displayed to show that the export was successful.
Click OK to close the Certificate dialog box.
Double click on the certificate listed under Token-decrypting.
To install the Token Decrypting certificate, perform Step 4 to Step 12.
In the ADFS 3.0 tree, click Service > Endpoints.
Under the Metadata section, locate the listing that has a type called Federation Metadata.
Make a note of the URL path as shown in the following image.
Modify the URL as follows.
https:// <VM/server name>/ Federation metadata url. (Machine where ADFS is installed)
e.g.:- https:// vw-pun-rem-dvbx.punremforce.local /FederationMetadata/2007-06/FederationMetadata.xml
Download this Metadata file that will be imported in Salesforce Single Sign-On settings.

To configure Single Sign-On in a Salesforce organization

Perform the following steps if you are using new organization or if you want to create a new Single Sign-On settings for an existing organization.

To create a domain name, navigate to the required path:
- For Salesforce Classic, go to Setup > Administer > Domain Management > My Domain.
- For Salesforce Lightning, go to Setup > Settings > Company Settings > My Domain.
Enter Domain Name and click Check Availability.
Click Register Domain.
Navigate to the required path:
- For Salesforce Classic, go to Setup > Administer > Security Controls > Single Sign-On Settings.
- For Salesforce Lightning, go to Setup > Settings > Identity > Single Sign-On Settings.
Click Edit and select SAML Enabled.
Click New from Metadata File.
Import metadata file that was downloaded while performing ADFS configuration.
Click Create. The following screen is displayed with the pre-populated fields.
Select SAML Identity Type: Assertion contains the Federation ID from the User object.
Click Save.
Click Download Metadata.
Save XML file to a directory that will be used in ADFS settings in Data source.

To enable a direct login button for Single Sign-On

Navigate to the required path:
- For Salesforce Classic, go to Setup > Administer > Domain Management > My Domain.
- For Salesforce Lightning, go to Setup > Settings > Company Settings > My Domain.
Under Authentication Configuration, click Edit.
Select checkbox for the SAML which you created before.
Click Save.
The login page displays an additional button as shown in the following image.

To configure Salesforce user settings

Log into Salesforce as a system administrator.
Navigate to the required path:
- For Salesforce Classic, go to Setup > Administer > Manage Users > Users.
- For Salesforce Lightning, go to Setup > Administration > Users > Users.
Locate the user whose credentials will be used for testing and click the user.
Click Edit.
In the Federation ID field, enter the fully qualified name of the user. In this example, it is: asdd2as@bmc.com
Click Save.

To configure ADFS 3.0

Build a trust relationship between Salesforce and ADFS 3.0 using the following steps:

In ADFS 3.0, click the root ADFS.
Under Actions > ADFS, click Add Relying Party Trust.
On the Welcome page, click Start.
On the Select Data Source page, click Import data about the relying party from a file.
In the Federation metadata file location field, select the metadata XML that you exported from Salesforce.
Click Next.
Enter a value in the Display name field. For example, RemedyforceSSO.
In the Note field, add any additional notes as required and then click Next.
Select I do not want to configure multi-factor authentication settings for this relying party trust at the time.
On the Choose Issuance Authorization Rules page, select Permit all users to access this relying party.
Click Next.
On the Ready to Add Trust page, click Next.
Ensure that the Open the Edit Claim Rules dialog for this relying party trust when the wizard closes check box is selected.
Click Close.
In the Issuance Transform Rules tab, click Add Rule.
For the Claim rule template, select Send LDAP Attributes as Claims and click Next.
Enter a value in the Claim rule name field. In this example, Remedyforce Claim rule.
In the Attribute store field, select Active Directory.
Under LDAP Attribute, select E-Mail-Addresses.
Under Outgoing Claim Type, select Name ID.
Click Finish and then click Ok.

To verify ADFS 3.0 Single Sign-On setup

Log into the domain as your test account. (Login to machine/VM where ADFS server setup is done)
Launch your browser and go to the ADFS IdP-initiated login URL which for this example is as follows:
https://vw-pun-rem-dvbx.punremforce.local/adfs/ls/IdpInitiatedSignOn.aspx?loginToRp=saml.salesforce.com
To validate SAML Assertion, navigate to the required path:
- For Salesforce Classic, go to Setup > Administer > Security Controls > Single Sign-On Settings.
- For Salesforce Lightning, go to Setup > Settings > Identity > Single Sign-On Settings.
Click the required single sign on setting name and then click SAML Assertion Validator.
Click Validate. The following screen is displayed.