Salesforce

Pre-Requisites

Salesforce Admin Portal Access.
Accops HySecure Gateway with Public DNS name and valid SSL Certificate.
Managenent console of HySecure Gateway using Secirity Officer Account.
Shell Access to Hysecure Gateway.

Configurations

Steps to setup Salesforce in Accops (Identity Provider)

Step 1: Login with a digital certificate in Accops HySecure Gateway using Security Officer Account.

Step 2: Go to "Access Management >> Applications >> Add" .

Step 3: Click on Add button to create new application as "Salesforce".

Note

Go to Salesforce Portal https://login.salesforce.com/ and login with your GLobal Admin and get the info of Salesforce Tenant.

Type : HTTPS
Name: Salesforce
Discription: Salesforce
Application Server Address: accops-dev-ed.lightning.force.com
Application Port: 443
Protocol: TCP
Web URL:  https://accops-dev-ed.lightning.force.com/lightning/setup/SetupOneHome/home
Use Reverse Proxy: No
Hidden Application: No
Hide Access Pop-up : No
Enable App Tunnling : Yes
Enable L3 VPN Tunneling : No
Enable Single Sign-on : Yes
Authentication Type : SAML Based
Preconfigured Service Provider : Salesforce
Service Provider Login URL: https://accops-dev-ed.my.salesforce.com
Service Provider Logout URL : https://accops-dev-ed.my.salesforce.com/services/auth/sp/saml2/logout
Audience : https://saml.salesforce.com
Issuer : https://sso.accops.cloud (HySecure Gateway Address)

Step 4: Add Salesforce app into New/Existing Application Groups.

Step 5: Create/Update an "Application Access" in New/Exisitng "Access Controls"

Step 6: Verify SAML SSO Certificate in Accops HySecure Gateway.

Please ensure below files availability in Accops HySecure Gateway.

Certificate Path: /home/fes/fescommon/certs/

    -rw-r--r-- 1 apache fes    2029 Mar 11 11:08 SAML_Signing_Certificate
    -rw------- 1 apache fes    2498 Mar 11 11:09 SAML_Signing_Private_Key

Note

If above files are not present then, Create it using below command after changing the Working Directory to "/home/fes/fescommon/certs/"


[root@sso1 ~]# cd /home/fes/fescommon/certs/

openssl x509 -inform PEM -in "sslcert.cer" -out SAML_Signing_Certificate

openssl rsa -in "sslcert.pem" -out SAML_Signing_Private_Key

Step 7: Copy the content of SAML SSO Certificate SAML_Signing_Certificate from Accops Gateway.

Warning

Please ensure that while copying the content there aren't any new line in SAML SSO Certificate

cat /home/fes/fescommon/certs/SAML_Signing_Certificate

Steps to setup Accops in Salesforce (Service Provider)

Step 1: Go to to Salesforce https://login.salesforce.com or https://domain.my.salesforce.com with Admin Access.

Step 2: After Login to Salesforce Portal, Go to Settings.

Step 3: Go to Settings >> Identity >> Single Sign-On Settings.

Step 4: Click on New

Step 5: Fill the Required Details.

Name: Accops_IDP_Server
API Name: Accops_IDP_Server
SAML Version: 2.0
Issuer: https://sso.accops.cloud                                     <Please replace *sso.accops.cloud* with your Accops IDP Server>
Entity ID: https://saml.salesforce.com
Identity Provider Certificate: Import *SAML SSO Certificate* from Accops HySecure Gateway. (As per Pre-requisites)
Request Signature Method: RSA-SHA256
Assertion Decryption Certificate: Assertion not encrypted
SAML Identity Type: Assertion contains the User's Salesforce username
SAML Identity Location: Identity is in the NameIdentifier element of the Subject statement
Service Provider Initiated Request Binding: HTTP POST
Identity Provider URL: https://sso.accops.cloud/saml-sso/salesforce  <Please replace *sso.accops.cloud* with your Accops IDP Server>
Custom Logout URL: https://sso.accops.cloud/saml-slo/salesforce      <Please replace *sso.accops.cloud* with your Accops IDP Server>

Step 6: Verify the IDP Settings and Endpoint details of Salesforce.

Your Organization Login URL https://accops-dev-ed.my.salesforce.com Logout URL https://accops-dev-ed.my.salesforce.com/services/auth/sp/saml2/logout

Click on Download Metadata to Configure the Identity Provider Server, If it is not configured

Go to Accops Workspace Portal (https://sso.accops.cloud)
Here you have to enter the sAMAccountName of the user

For Example:
```
Username: pravind.kumar
Password: xxxxxx
Domain: accops.cloud
```
Enter Your Login Credentials, Choose domain from dropdown and click on Sign In.
Verify yourself using Multi-Factor Autentcication by choosing the type of MFA from dropdown.
Post successful Autentication and Authorization User will will be redirected to Accops Workspace Portal.
Click on Salesforce icon to launch Single Sign On access to Salesforce Portal.

Go to to Salesforce https://accops-dev-ed.my.salesforce.com and select Login using Accops SSO
Autentication request will be redirected to Organization Sign in Page (Accops IDP Login Portal), Enter Authentication details and click on Sign-In.
Here you have to enter the sAMAccountName of the user

For Example:
```
Username: pravind.kumar
Password: xxxxxx
```
On Below Screen, Accops IDP Server will Prompt More Authenication required, Choose Send Push to Mobile/Desktop and Authorize the Desktop Push to Login.
Access Salesforce Portal.

Salesforce

Pre-Requisites

Configurations

Steps to setup Salesforce in Accops (Identity Provider)

Steps to setup Accops in Salesforce (Service Provider)

Sign in to your Salesforce

Using IDP initiated login

Using SP initiated login