Enable SSO between 2 salesforce communities
Hello Everyone ,
I hope you all have read my recent post. Recently
I have implemented SSO between 2 salesforce communities. Let’s start how I did
this using salesforce’s out of the box functionality.
Use Case: one organisation was using the salesforce and salesforce
community(let's name it cloudkicks) , later they acquired another organisation
another company and that company was also using the salesforce and salesforce
community(name it iCourier). Now the
stakeholder of the parent organisation wanted that users of their community can
login directly in the acquired company’s community portal.
So in this case cloudkicks will act as Identity
provider (Source organisation) and iCourier will act as service provider
(Target community where we want to login).
Following steps we need to take :
1.
Enable Identity provider in source
org.
2.
Enable Single Sign on in the
target org.
3.
Create a connected app in the
source org.
Let’s see them step by step how that will be
working.
1. Enable Identity provider in
source org:
a.
If identity provider is not
already enabled in org then first enable it.
Once we click on the
enable identity provider button we will be asked to select a certificate, you
can select existing one or also can create new.
b. Download metadata and
certificate: Once we have enabled identity provider in
our source org we need to download metadata file, which will be used for
enabling single sign on in the target org.
2. Enable Single Sign on in the
target org
a. SAML Enabled:
b. Create SAML Sign-On Settings: We can click on a new button and fill all the details manually,or we
can use metadata file by clicking on the ‘New from Metadata file’ button. We will use a metadata file which we
used from step 1.
All details will be filled automatically. We
would need to make the following changes for red highlighted fields.
Request
Signature Method: RSA-SHA1
Service
Provider Initiated Request Binding: HTTP POST
Identity
Provider Login URL: Keep it blank for now , we will
come back to it later.
3. Create connected app in the
source org: We will create a connected app in the
source org (cloud kicks) .
In the connected app ,
enable SAML, we need some information here that will be provided by target org
when they enable single sign on setting.
Lets see where we can get entity url and ACS URL
from the target org.Both details are available on the detail page of single
sign on setting which we created in step 2.
Entity Id
:
ASC URL: Is the endpoint of login url where we need to provide login access.
Once we save connected app , click on manage
button and assign profiles who will be using this connected app (cloudkicks
community user profile)
Now we need to copy ‘IdP-Initiated Login URL’ and
put it on the single sign on settings, remember we put 1 blank value there.
Copy from
the connected app
Paste on
the single sign on setting page in target org.
Now we are done with the setup. We can call this
url on any button click from target community (Cloudkicks) and it will allow us
to login into source org community (iCourier).
Note: We
can set federation Id on user detail page, make sure federation id should be
same in both orgs for a user, this will be used to authenticate the user.
