Azure Active Directory Seamless Single Sign-On with Salesforce

Amit Chaudhary DevOps Ci/CD

In this session we talk about how to implement Azure Active Directory Seamless Single Sign-On with Salesforce. We also cover the Delegated Authentication and Federated Authentication(SAML) SSO.

  • Single Sign On
    • Delegated Authentication
    • Federated Authentication(SAML)
  • Identity Provider(IP)
  • Service Provider(SP)

Delegated Authentication Use delegated authentication if you have mobile users in your organization, or if you want to enable single-sign on for partner portals or Customer Portals. You must request that this feature be enabled by salesforce.com. This recipe explains delegated authentication in more detail.

Federated Authentication using SAML Federated authentication uses SAML, an industry standard for secure integrations. Investing in SAML with Salesforce.com can be leveraged with other products or services. If you use SAML, you don’t have to expose an internal server to the Internet: the secure integration is done using the browser. In addition, Salesforce.com never handles any passwords used by your organization. For more information, see “Configuring SAML Settings for Single Sign-On” in the Salesforce.com online help.

Difference

Delegated authentication has a few drawbacks with respect to federated authentication.

1, delegated authentication is inherently **less secure than federated authentication**. Even if encrypted, delegated authentication still sends the username and password (possibly even your network password) over the internet to Force.com. Some companies have policies that preclude a third party for handling their network passwords.

2, delegated authentication **requires much more work for the company implementing it**. The Web services endpoint configured for the org must be developed, hosted, exposed on the Internet, and integrated with the company’s identity store.

IDP INITIATED FLOW

  • User login into Identity Provider with the credentials
  • User Click on the link for which org user want to access
  • SAML Assertion is sent to salesforce server with Federation ID or Username OR custom attribute

SP INITIATED FLOW

User experience: – The most apparent benefit is that users can move between services securely and uninterrupted without specifying their credentials each time.

Security: – The users credentials are provided directly to the central SSO server, not the actual service that the user is trying to access, and therefore the credentials cannot be cached by the service.

Resource Saving: – IT administrators can save their time and resources by utilizing the central web access management service  Application.

Recording

If you are new in Salesforce. Please check our free Salesforce Admin and Salesforce Developer training. Subscribe to the channel if you haven’t already

Thanks,
Salesforce Apex Hours


118 total views, 1 views today

Leave a Reply