Introduction

Salesforce supports different types of authentication methods, these include Salesforce local authentication, SAML, OpenID Connect and Delegated authentication. NAM 4.0 and above can be used for Salesforce delegated authentication. In the case of Delegated authentication, Salesforce invokes NAM webservice with SOAP payload which includes username and password, This type of authentication is popular for mobile API access of Salesforce. Delegated authentication can be enabled at the user profile or large group.

Solution

Deploy the webservice on NAM IDP and configure Salesforce for delegated authentication.

To enable Salesforce for delegated authentication, contact Saleforce or raise a support ticket to enable this feature. For additional information refer to this Salesforce documentation: https://help.salesforce.com/apex/HTViewHelpDoc?id=sso_delauthentication_configuring.htm&language=en

Ensure IDP is accessible from the Internet publicly, and the SSL certificate is issued from a well-known certificate authority.

This solution will give basic steps to setting up NAM custom X.509 authentication.

Configuration steps

1. Download attached zip file and extract to temporary folder

• Copy the jar file to NAM IDP lib folder location /opt/novell/nam/idp/webapps/nidp/WEB-INF/lib

• If you want to specify which Authentication Method is to be used, the authentication method display name has to be added in web.xml. If this parameter not configured by default “Name/Password – Form” method will be executed to validate Salesforce provided credentials.

Add the following to web.xml of IDP /opt/novell/nam/idp/webapps/nidp/WEB-INF/web.xml

<servlet>

<servlet-name>sfdelegate</servlet-name>

<init-param>

<param-name>method_name</param-name>

<param-value>Name/Password – Form</param-value>

</init-param>

</servlet>

4. Restart IDP /etc/init.d/novell-idp restart

• If Name/Password – Form method has to validate Email and password, configure Query parameter with this method. Refer to NAM documentation. This is optional step to be configured at NAM Admin Console.

• Login to Salesforce administration page for your organization

• Click Setup > Administration Setup > Security Controls > Single Sign-On Settings > Edit

• In the Delegated Gateway URL field, specify a value similar to the following: https://<NAM_IDP_public_dns_name>/nidp/sf/soap

• Under Setup > Administration Setup > Manage Users > Profiles, Open a User Profile you would like to enable delegated authentication.

• Click Edit on the user profile and scroll down to the General User Permissions section and check the Is Single Sign-On Enabled checkbox

• Click Save

Test Configuration

1. Use “POST MAN” extension in Chrome browser

• Select POST as HTTP method and enter URL https://<NAM_IDP_public_dns_name>/nidp/sf/soap

• Set Header “Content-Type: text/xml”

• Body type as “raw” and copy paste the Salesforce request, modify username and password with testuser.

<?xml version="1.0" encoding="UTF-8" ?>

<soapenv:Envelope

xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">

<soapenv:Body>

<Authenticate xmlns="urn:authentication.soap.sforce.com">

<username>sampleuser@sample.org</username>

<password>myPassword99</password>

<sourceIp>1.2.3.4</sourceIp>

</Authenticate>

</soapenv:Body>

</soapenv:Envelope>

5. Click on Send

• Check the result, SOAP response with value as true or false

• If IDP webservice is working fine with the above test, access your Salesforce url as https://<organization>.salesforce.com/ or https://login.salesforce.com

• Enter user credentials where delegated authentication is enabled for this user.

Note: Delegated authentication will be used with like outlook plugin and other APIs

References

• https://www.netiq.com/documentation/cloudaccess_2_1/connectors/data/salesforce-delegated-auth.html

• https://help.salesforce.com/apex/HTViewHelpDoc?id=sso_delauthentication_configuring.htm&language=en

• https://help.salesforce.com/apex/HTViewHelpDoc?id=sso_tips.htm&language=en

• https://help.salesforce.com/apex/HTViewHelpDoc?id=sso_saml_assertion_examples.htm&language=en_US#saml_assertion_examples_delauth

Please share your comments!!