Configuring Salesforce for Shibboleth IdP (newbie)

[Joshua Riffle]

The user group didn't like my large attachment so I'll just do it the
"Google" way link to the SalesForce SSO document that I worked awhile
ago... I think it might be missing the part about turn off encryption
specifically for SalesForce if so I noted it below:

https://docs.google.com/file/d/11Fyp_GmnLlyIyN4nM-dJFlh2ii8HgawW3sAHSEhD8g1hEqBiK9Cmbkj9mV5B/edit?usp=sharing

Addition to relying-party.xml:
    <!-- Special for SalesForce. This disables encryption because they
don't support it -->
    <rp:RelyingParty id="https://*PROVIDEDENTITYID*.my.salesforce.com"
provider="https://idp.example.com/"
defaultSigningCredentialRef="IdPCredential">
        <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never" />
    </rp:RelyingParty>




Joshua Riffle
Software Engineer
*Azusa Pacific University*


On Thu, Oct 10, 2013 at 3:08 PM, Nate Klingenstein <ndk at internet2.edu>wrote:

> Joaquin,
>
> > I'm realtively new to SAML and Shibboleth and I am at the phase to
> configure account information SSO configuration withSalesforce.com.
>
> These questions are more for Salesforce and less for Shibboleth.  You
> might ask them.  I can only guess at their interpretation.
>
> It would also be good to ask them when they will be able to support
> metadata, which would remove the need for their customers to answer(and
> maintain the answers to) these questions.
>
> > Issuer:
> > https://idp.example.com:9443/idp/profile/SAML2/POST/SSO
>
> They probably mean entityID here, which would be in your default
> installation:
>
> https://idp.example.com:9443/idp/shibboleth
>
> You can and should customize this in relying-party.xml to something that
> makes sense for your organization.
>
> > Identity Provider Login URL:
> > https://idp.example.com:9443/idp/shibboleth
>
> They probably mean something using the IdP Unsolicited SSO profile handler.
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO
>
> > Also, how would go about (on CentOS 6.3), creating an " Identity
> Provider Certificate" that Salesforce requires?
>
> There is a certificate automatically generated for you during installation
> and placed in /opt/shibboleth-idp/credentials/.   You may choose to use
> that certificate or any other certificate you'd like as long as it's
> consistent.
>
> Thanks,
> Nate.
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131010/5efb7ff2/attachment.html