<div dir="ltr"><div>The user group didn't like my large attachment so I'll just do it the "Google" way link to the SalesForce SSO document that I worked awhile ago... I think it might be missing the part about turn off encryption specifically for SalesForce if so I noted it below:<br>
<br><a href="https://docs.google.com/file/d/11Fyp_GmnLlyIyN4nM-dJFlh2ii8HgawW3sAHSEhD8g1hEqBiK9Cmbkj9mV5B/edit?usp=sharing">https://docs.google.com/file/d/11Fyp_GmnLlyIyN4nM-dJFlh2ii8HgawW3sAHSEhD8g1hEqBiK9Cmbkj9mV5B/edit?usp=sharing</a><br>
<br></div>Addition to relying-party.xml:<br> <!-- Special for SalesForce. This disables encryption because they don't support it --><br> <rp:RelyingParty id="https://<u>PROVIDEDENTITYID</u>.<a href="http://my.salesforce.com">my.salesforce.com</a>" provider="<a href="https://idp.example.com/">https://idp.example.com/</a>" defaultSigningCredentialRef="IdPCredential"><br>
<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" /><br> </rp:RelyingParty><br><div><br><br></div></div><div class="gmail_extra">
<br clear="all"><div><font face="tahoma, sans-serif"><div><font face="tahoma, sans-serif"><br></font></div>Joshua Riffle</font><div><font face="tahoma, sans-serif">Software Engineer<br></font><div><font color="#CC0000" face="tahoma, sans-serif"><b>Azusa Pacific University</b></font></div>
</div></div>
<br><br><div class="gmail_quote">On Thu, Oct 10, 2013 at 3:08 PM, Nate Klingenstein <span dir="ltr"><<a href="mailto:ndk@internet2.edu" target="_blank">ndk@internet2.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Joaquin,<br>
<div class="im"><br>
> I'm realtively new to SAML and Shibboleth and I am at the phase to configure account information SSO configuration withSalesforce.com.<br>
<br>
</div>These questions are more for Salesforce and less for Shibboleth. You might ask them. I can only guess at their interpretation.<br>
<br>
It would also be good to ask them when they will be able to support metadata, which would remove the need for their customers to answer(and maintain the answers to) these questions.<br>
<br>
> Issuer:<br>
> <a href="https://idp.example.com:9443/idp/profile/SAML2/POST/SSO" target="_blank">https://idp.example.com:9443/idp/profile/SAML2/POST/SSO</a><br>
<br>
They probably mean entityID here, which would be in your default installation:<br>
<br>
<a href="https://idp.example.com:9443/idp/shibboleth" target="_blank">https://idp.example.com:9443/idp/shibboleth</a><br>
<br>
You can and should customize this in relying-party.xml to something that makes sense for your organization.<br>
<div class="im"><br>
> Identity Provider Login URL:<br>
> <a href="https://idp.example.com:9443/idp/shibboleth" target="_blank">https://idp.example.com:9443/idp/shibboleth</a><br>
<br>
</div>They probably mean something using the IdP Unsolicited SSO profile handler.<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO</a><br>
<div class="im"><br>
> Also, how would go about (on CentOS 6.3), creating an " Identity Provider Certificate" that Salesforce requires?<br>
<br>
</div>There is a certificate automatically generated for you during installation and placed in /opt/shibboleth-idp/credentials/. You may choose to use that certificate or any other certificate you'd like as long as it's consistent.<br>
<br>
Thanks,<br>
Nate.<br>
<div class="HOEnZb"><div class="h5">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>