A human hand is reaching out to touch a CPU chip with gears on top of it. The chip is a digital representation with circuit board like elements surrounding it.

This blog is a guide on how to setup IBM Access manager (v9.0.7.0) and Salesforce SAML 2.0 Federation.

Salesforce Registration and Domain Setup

Step 1: Create Salesforce Developer Account

1. Visit: https://developer.salesforce.com/ and sign up for an account.

2. Follow instructions and verify your account

Step 2: Configure the Salesforce Domain

1. Login to Salesforce: https://login.salesforce.com/

2. Find the search bar in left navigation panel and search for My Domain.

3. Type in your unique domain name and click Check Availability button.

4. Once you verify your domain is available click on Register Domain button.

5. Log out from your Salesforce session and wait for an email saying your domain is ready for testing, this could be from a few minutes to couple of hours.

6. Follow email instruction and test out your domain.

7. Login to Salesforce > go to My Domain > Deploy to Users.

8. Take note of your domain URL: e.g. https://iamteam.werbx.com-dev-ed.my.salesforce.com/

Step 3: Generate Salesforce Self-Signed Certificate

1. Login to Salesforce: https://login.salesforce.com/

Selecting: Certificate and Key Management

Note: Certificate and Key Management page appears on the right.

2. Search for: Certificate and Key Management.

3. Click on Create Self-Signed Certificate.

4. Type a label and unique name then save the changes.

Label: SalesForceSSO
Unique Name: SalesForceSSO

5. Click on SalesForceSSO.

Configuring IBM ISAM as SAML 2.0 IdP (Identity Provider)

Step 1: Importing Identity Provider Key Database

This is part of provided support file federation cookbook from IBM and is available for download from: IBM Community.

1. Log-in to ISAM as admin.

2. Navigate to Manage Systems Settings > Secure Settings > SSL Certificates.

Manage System Settings > Secure Settings > SSL Certificates

3. Browse for: myidpkeys.kdb and myidpkeys.sth for Certificate Database and Stash file respectively.

4. Deploy the changes.

Step 2: Importing the Salesforce Self-Signed Certificate

1. Log-in to ISAM as admin.

2. Navigate to Manage Systems Settings > Secure Settings > SSL Certificates.

3. Select myidpkeys > Edit SSL Certificate Database.

4. On the Edit SSL Database window Click on Manage > Import.

5. On the Import Signer Certificate Browse for SalesForceSSO.crt file and put label: Salesfroce public key.

5. Review, save and deploy all changes.

Step 3: Exporting the IdP Certificate to a File

1. Log-in to ISAM as admin.

2. Navigate to Manage Systems Settings > Secure Settings > SSL Certificates.

3. In the SSL Certificates page, select myidpkeys from the list and click the Manage > Edit SSL Certificate Database option. The Edit SSL Certificate Database window appears.

4. Go to the Personal Certificates tab and select the myidpkey certificate.

5. Click Manage > Export.

Edit SSL Certificate Database - myidpkeys - Export

6. Save the certificate as myidpkey.cer file.

Note: You will need this later, see Creating SAML Single Sing-On Definition in Salesforce section for details.

7. Close Edit SSL Certificate Database window.

Configuring IBM Access Manager as SAML 2.0 Identity Provider

Step 1: Create SAML 2.0 Quick Connect Identity Provider (IdP) Federation

1. Log-in to ISAM as admin.

2. Navigate to Secure Federation > Manage > Federations.

3. Click Add button to add new federation.

Adding new federation - Federation Management

4. Type QuickFed as federation name and select SAML 2.0.

5. On the Template screen select Quick Connect.

6. For Point of Contact, type https://<reverse proxy hostname>/isam.

e.g. https://iamteam.werbx.com/isam

7. On the Signature Options screen:

Certificate Database: myidpkeys
Certificate Label: myidpkey

8. Same entries for Encryption Option screen.

9. Review the summary and click the OK button.

10. Deploy the changes.

Step 2: Exporting Federation Metadata

1. Log-in to ISAM as admin.

2. Navigate to Secure Federation > Manage > Federations.

3. Select the newly created QuickFed Federation and click on Export.

4. Take note of file system location of: federation_metadata.xml you will need this later along with the exported myidpkey personal certificate when setting up Single Sign-on in Salesforce.

Setup Reverse Proxy

In this example a reverse proxy named: iamteam is already created.

Step 1: Modify Reverse Proxy

1. Log-in to ISAM as admin.

2. Navigate to Secure Web Settings > Manage > Reverse Proxy.

3. Select reverse proxy iamteam and select Manage > Configuration > Edit Configuration File.

4. Use your browser find tool (Ctrl+f) to find and edit the following:

[server]
web-host-name = iamteam.werbx.com
[step-up]
verify-step-up-user = no
[session]
user-session-ids = yes
inactive-timeout = 1800
create-unauth-session = yes

5. Save, deploy the changes and restart iamteam reverse proxy instance

Step 2: Configure Reverse Proxy as Point of Contact for Federation

1. Log-in to ISAM as admin.

2. Navigate to Secure Web Settings > Manage > Reverse Proxy.

3. Select reverse proxy iamteam and select Manage > AAC and Federation > Federation Management.

AAC and Federation Configuration - Federation Management

4. On the Federation Management Page click Add.

5. On Runtime tab enter the following values and click Next:

Hostname: localhost
Port: 443
Username: easuser
Password: <password>

Note: the default password is passw0rd. To change the password for easuser go to Secure Federation > Global Settings > User Registry, then select easuser and click Set Password.

Integrating IBM Access Manager and Salesforce

Step 1: Configuring General, Single Sign-On & Signature Options

1. Log-in to ISAM as admin.

2. Navigate to Secure Federation > Manage > Federations.

3. Select QuickFed Federation and click Partners.

4. Click Add to add new partner.

5. Fill in General Information.

Name: SalesForce
Check Enabled

6. Single Sign-On Settings.

Provider ID: <Salesforce registered domain>.
- e.g. https://iamteamlab-dev-ed.my.salesforce.com.
Note: See Configuring Salesforce domain section for details.

7. Signature Options.

Does SP sign the Authentication request? Checked
Certificate Database: myidpkeys
Certificate Label: Salesforce public key

8. Encryption Options: keep the default settings and click Next.

9. Mapping Rules Options: keep the default settings and click Next.

10. Attribute Mapping Options: keep the default settings and click Next.

11. Review the Summary and click OK, verify that partner is added successfully.

12. Deploy changes.

Step 2: Enabling SAML on Salesforce

1. Login to Salesforce: https://login.salesforce.com.

2. On the Quick Find toolbar search for Single Sign-On Settings.

3. Enable Single Sign-On Settings using SAML.

Step 3: Create Single Sign-On on Salesforce

1. Login to Salesforce: https://login.salesforce.com.

2. On the Quick Find toolbar search for Single Sign-On Settings.

3. Click New from Metadata File button under SAML Single Sign-On Settings.

4. Browse for federation_metadata.xml file (see Exporting Federation Metadata section for details).

Browsing for federation_metadata.xml in SAML Single Sign-On Settings

5. The fields are now pre-filled, verify Information and save.

Identity Provider Certificate: Browse for certificate from IdP.
(See section: Exporting IdP certificate to a file)
Uncheck: Single logout option.

6. Click on the newly created SSO settings and verify the endpoints.

Note: Take note of Login URL. This should be the same value as the URL field when adding Salesforce as Federation Partner, update settings in IBM Access Manager as applicable.

Step 4: Add IBM Access Manager as an Authentication Service in Salesforce

1. Login to Salesforce: https://login.salesforce.com.

2. On the Quick Find toolbar search for My Domain.

3. Click Edit button of Authentication Configuration.

4. Check IAMTEAM under Authentication Service.

5. Save changes.

Testing Login Flows

Prerequisites:

Be sure to logout from both ISAM and Salesforce console before testing each flow.
Be sure your browser can access both Salesforce and your local/virtual network.

Step 1: Identity Provider (Idp) Flow

1. Navigate to: https://iamteam.werbx.com/isam/sps/QuickFed/saml20/logininitial?NameIdFormat=Email&PartnerId=https://iamteamlab-dev-ed.my.salesforce.com.

Note: Replace: https://iamteam.werbx.com with your reverse proxy hostname and https://iamteamlab-dev-ed.my.salesforce.com with your Salesforce domain.

2. IBM Access Manager reverse proxy login page should display.

3. Enter credentials of test users and verify that you are redirected and logged in to Salesforce.

Step 2: Service Provider (SP) Flow

1. Navigate to your Salesforce domain.

e.g. https://iamteamlab-dev-ed.my.salesforce.com.

2. Do not enter your Salesforce credential on your domain's login page. Instead, click Log-in using IAMTEAM just below the form. You will be redirected to your reverse proxy login page. (IAMTEAM is the configured SSO name. See section: Create Single Sign-On on Salesforce).

3. On your IBM Access Manager reverse proxy login page, enter your credentials, you will then be redirected back and logged into your Salesforce domain.

How to Setup IBM Access Manager & Salesforce Federation

Services

Solutions

Pricing

Resources

Events

About Us

Get Started