How to configure Salesforce single sign-on in IDaaS-Identity as a Service(IDaaS)-阿里云帮助中心

Configure single sign-on (SSO) between Alibaba Cloud Identity as a Service (IDaaS) and Salesforce using SAML 2.0. After setup, users log on to Salesforce through their IDaaS account without entering a separate password.

Prerequisites

Before you begin, ensure that you have:

An active IDaaS instance with administrator access
A Salesforce account with administrator access

How it works

The configuration flows across both systems in sequence:

Add the Salesforce application in IDaaS and download the identity provider (IdP) certificate.
Configure SAML SSO in Salesforce using the IdP parameters from IDaaS, then copy the Salesforce sign-in URL.
Enter the Salesforce sign-in URL back in IDaaS to complete the service provider (SP) configuration.
Test SSO from the IDaaS portal.

Step 1: Add the Salesforce application in IDaaS

In the IDaaS console, go to Application > Marketplace and search for Salesforce.
Select the Salesforce application template, confirm the application name, and complete the Add Application process. IDaaS redirects you to the SSO configuration page. The Application Settings section at the bottom of the page lists the IdP parameters you need for Salesforce.
Click Download CER Certificate File to save the certificate to your computer. You upload this certificate to Salesforce in the next step.

Step 2: Configure SSO in Salesforce

Open single sign-on settings

Log on to the Salesforce management platform in a new browser tab.
Click the Settings icon in the upper-right corner, then select Setup.
Go to Settings > Identity > Single Sign-On Settings.

If the page fails to load or does not respond, try a different browser. Some browsers block cross-domain cookies. You can also switch to Salesforce Classic as prompted.

Configure SAML

On the SAML Single Sign-On Settings page, click New.

Fill in the following fields using the values from the Application Settings section in IDaaS. Leave all other fields at their default values.

Salesforce field	Alias	Value
Name	—	IDaaS (or any name you choose)
API Name	—	IDaaS (or any name you choose)
Issuer	IdP Entity ID	Copy the `IdP Entity ID` from IDaaS. The values in both systems must match.
Entity ID	SP Entity ID	`http://saml.salesforce.com`. The values in both systems must match.
Identity Provider Certificate	Certificate	Upload the CER certificate file you downloaded from IDaaS.
Identity Provider Login URL (optional)	IdP sign-in URL and SAML SSO URL	Copy the `IdP SSO URL` from IDaaS. Required for SP-initiated SSO — Salesforce sends SAML requests to this URL to start the SSO flow.

Click Save. Salesforce redirects you to the configuration details page. Copy the sign-in URL at the bottom of the page. You enter this URL in IDaaS in the next step.

SSO is disabled in Salesforce by default after saving. Complete the next sub-step to enable it.

Enable SAML SSO

Go back to the SSO configuration page in Salesforce.
Click Edit, select Enable SAML SSO, and save.

Step 3: Configure SSO in IDaaS

Go back to the IDaaS console. On the SSO configuration page for the Salesforce application, enter the sign-in URL you copied from Salesforce.
Leave all other parameters at their default values and click Save.

The App User parameter controls which identity IDaaS uses for SSO. For details on setting up application accounts, see Configure Application User for SAML. The Authorize parameter defaults to Manually for security. To simplify testing, change it to All Users.

Step 4: Test SSO

Log on to the IDaaS portal using an IDaaS account that has access to the Salesforce application.
Click the Salesforce icon on the portal page. IDaaS initiates SSO and logs you in to Salesforce automatically. If the login succeeds, the configuration is complete.