Use the information in the following sections to configure a connector for Salesforce:
Verify that you meet the following requirements before configuring the connector for Salesforce:
A full or developer account with provisioning APIs enabled
An administrative account with password
The metadata file from Salesforce
(Conditional) A security token from Salesforce
NetIQ recommends that you configure Salesforce to trust the IP address of the CloudAccess appliance.
To add the CloudAccess IP address as a trusted source to Salesforce:
Log in to the Salesforce Admin tools Web page.
Click Administration Setup > Security Controls > Network Access.
Specify the IP address of the CloudAccess appliance.
or
If you are in a clustered environment, specify the IP address of the L4 switch.
If you do not configure Salesforce to trust the IP address of the CloudAccess appliance, you must obtain a security token from Salesforce and append the security token to the administrator password specified when you configure the connector for Salesforce.
For example, if your Salesforce administrator account password is Test1234 and the Salesforce security token is XyZ, the Password field must contain Test1234XyZ.
Each cluster supports multiple connectors for Salesforce. You must configure the connector for Salesforce to provision accounts into Salesforce.
You can configure the connector to allow users single sign-on access into Salesforce. When users log in to the identity source, CloudAccess automatically authenticates the users to Salesforce. Providing single sign-on to users increases the security of your company’s information stored in Salesforce. The phone icon that CloudAccess displays on all the Salesforce connectors indicates that Delegated Authentication can be used with Salesforce. All of the configuration required for using Delegated Authentication with CloudAccess is done at Salesforce.
You must go back and forth between the CloudAccess Admin page and the Salesforce administration page to configure the connector.
In CloudAccess, access the Admin page.
For more information, see Section 3.1, Accessing the Administration Pages.
Drag and drop the Connector for Salesforce from the SaaS Palette to the bar.
Click the Connector for Salesforce, then click Configure.
Provide a unique display name for the connector to appear on the Admin page, and administrator logon credentials for Salesforce.
Select Prompt users for an existing Salesforce account before provisioning if you want to give users control of when their accounts are provisioned. Note that if you want to use Delegated Authentication, you cannot use Prompt before Provisioning. These are mutually exclusive options. For more information about account provisioning, see Section 1.6, How CloudAccess Merges Existing Accounts.
Click Federation Instructions and read the instructions provided to configure the connector for Salesforce to allow single sign-on for users.
Copy and paste the text of the signing certificate provided in the Federation Instructions into a file, then save the file.
NOTE:Ensure that you use a text editor that does not introduce hard returns or additional white space. Otherwise, the certificate file may be improperly formatted and unusable. For example, use Notepad instead of Wordpad.
Log in to Salesforce as an administrator and complete the following steps:
Select Administration Setup from the drop-down menu.
Click Security Controls under Administration Setup in the left pane.
Click Single Sign On Settings.
Click Edit, then use the following information to configure single sign-on:
SAML Enabled: Check this option.
SAML Version: Specify 2.0.
Issuer: Copy and paste the value of the Entity ID provided in the Federation Instructions.
Identity Provider Certificate: Click Browse, then browse to and select the file to which you copied and pasted the signing certificate in Step 7.
Identity Provider Login URL: Copy and paste the value of the Single Sign-on URL provided in the Federation Instructions.
Custom Error URL: Leave this blank.
SAML User ID Type: Select Assertion Contains the Federation ID from the User Object. This option is not selected by default.
SAML User ID Location: Select User ID is in the NameIdentifier element of the Subject statement.
Identity Provider Logout URL: Copy and paste the value of the Single Logout URL in the Federation Instructions.
Download the Salesforce metadata file after the configuration is complete.
On the CloudAccess Admin page, edit the Connector for Salesforce.
Upload the metadata file generated in Step 9 into the connector for Salesforce.
Click OK, then click Apply to commit the changes to the appliance.
If you want to configure more than one connector for Salesforce, each Salesforce account must be configured with a unique URL. Configuring the URL requires Salesforce assistance and it often takes at least a day to complete.
To configure the Salesforce URL:
Log in to the Salesforce administration Web page.
Click Administration Setup > Company Profile > My Domain.
Provide a unique subdomain name for your organization and click Check Availability.
If the subdomain you specified is available, select the check box to indicate that you agree to the terms and conditions, then click Register Domain.
Wait for Salesforce to register your domains. This process takes time.
After the registration is complete, Salesforce provides you with a URL that supports SP-initiated logins and is similar to the following:
https://<custom name>.mysalesforce.com
Salesforce allows two different types of authentication methods: SAML and delegated authentication. By default, Salesforce activates only the SAML authentication. SAML is available only for browser-based authentication and does not work for applications that use the Salesforce Web Service API. For example, smart phones use the Salesforce Web Service API.
Delegated authentication must be activated on a per-Salesforce organization basis. This allows CloudAccess to support users authenticating with smart phones as well as users authenticating with browsers.
For delegated authentication to work properly with CloudAccess, the DNS name of the CloudAccess cluster must be publicly resolvable and the SSL certificate must be signed by a well known certificate authority (CA).
To configure Salesforce for delegated authentication:
Follow the instructions in the Salesforce documentation to enable delegated authentication single sign-on for your organization.
For more information, see Configuring Salesforce for Delegated Authentication.
Configure a connector for Salesforce in CloudAccess.
Log in to the Salesforce administration page.
Click Your Name > Setup > Security Controls > Single Sign-On Settings > Edit.
In the Delegated Gateway URL field, specify a value similar to the following: https://cloudaccess_public_dns/osp/a/t1/auth/external/sfda.
Do not select Force Delegated Authentication Callout.
This option affects the performance of user logins.
Enable the Is Single Sign-On Enabled permission. Note that if you want to prompt users to validate their accounts, you must disable this option instead. For more information about prompt before provisioning, see Section 1.6, How CloudAccess Merges Existing Accounts.
Now when end users authenticate to Salesforce through their smart phones, they use their identity source user name and password to authenticate just as they do from a browser.