<div dir="ltr">Hi. We're using Shibboleth 2.4.3 as IDP and integrate it with the dotCMS system. dotCMS is the platform of our intranet and it needs to use the RemoteUser login handler). <div><br></div><div>We also integrate with Salesforce as SP. With our current configurations, we have 2 user scenarios:</div><div><br></div><div>Scenario 1 : If a user logs into dotCMS and then clicks on a link to Salesforce that is on a page on dotCMS, it does a single-sign-on correctly and the user lands on the home page at Salesforce after logging in.</div><div><br></div><div>Scenario 2: If a user puts the same salesforce link in a new browser, the user just goes straight through to the "login error" page at Salesforce instead of being directed to the login page of dotCMS. Upon looking at the shibboleth logs, it says that no user identiified by login handler. From the SAML tracer in firefox, I can see a SAML request and then followed by a SAML response without getting the login page of the dotCMS.<br></div><div><br></div><div>I can somehow understand why this behavior occurs (it's because the Salesforce configuration is using RemoteUser login handler as well, which is expecting the same stuff we send in the dotCMS case). Since Salesforce is not sending the same user information to the IDP, it just falls through with no user info and hence login error.</div><div><br></div><div>My question is : What should I do to, I presume, the Salesforce configuration, so that scenario 2 will work as follows: User puts in the salesforce url in a new browser, gets directed to the login page of dotCMS. Upon entering the user's credentials, the user logs in to Salesforce and lands onto the home page at Salesforce.</div><div><br></div><div><div>My current configuration for Salesforce in the relying-party.xml is as follows:</div><div><br></div><div><div><i><rp:RelyingParty id="<a href="https://saml.salesforce.com">https://saml.salesforce.com</a>" provider="<a href="https://idp.myintranet.com/idp/shibboleth">https://idp.myintranet.com/idp/shibboleth</a>" defaultSigningCredentialRef="IdPCredential"></i></div><div><i> <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never"/></i></div><div><i></rp:RelyingParty></i></div></div><div><br></div><div>I have also tried the following:</div><div><div><i><rp:RelyingParty id="<a href="https://saml.salesforce.com">https://saml.salesforce.com</a>" provider="<a href="https://idp.rlpnetwork.com/idp/shibboleth">https://idp.rlpnetwork.com/idp/shibboleth</a>" defaultSigningCredentialRef="IdPCredential" <font color="#ff0000">defaultAuthenticationMethod="ph:UsernamePassword"</font>></i></div><div><i> <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never"/></i></div><div><i></rp:RelyingParty></i></div></div><div><i><br></i></div><div>and </div><div><i><br></i></div><div><div><div><i><rp:RelyingParty id="<a href="https://saml.salesforce.com">https://saml.salesforce.com</a>" provider="<a href="https://idp.rlpnetwork.com/idp/shibboleth">https://idp.rlpnetwork.com/idp/shibboleth</a>" defaultSigningCredentialRef="IdPCredential" <font color="#ff0000">defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"</font>></i></div><div><i> <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never"/></i></div><div><i></rp:RelyingParty></i></div></div></div><div><i><br></i></div><div>Unfortunately, neither worked.</div><div><i><br></i></div><div><br></div><div>Note: Before we integrate with dotCMS, I use the UsernamePassword loginHandler and Salesforce SSO was working at that time.</div><div><br></div><div>Any help is appreciated.</div><div><br></div><div> -Andrew<br clear="all"><div><br></div><div class="gmail_signature"><div dir="ltr"><br></div></div>
</div></div></div>