Now we’ll look at configuring SAML integration between VMware Identity Manager and Salesforce for Workspace ONE.

Definition:  Security Assertion Markup Language (SAML). It is an open standard which enables SSO for many different services and platforms. Authenticating with SAML allows a user to log in once per session.

Here are the defining components of SAML:

• Service provider (i.e. an application.)
• Identity provider (who is authenticated, and what authentication methods are used.)
• End user who is accessing over SAML.

 

1. User starts the SAML Application
2. Service Provider (SP) sends a request to the Identity Provider (IdP) for authentication
3. If the user is not authenticated, the IdP requests authentication from the user. (I.e. username and password)
4. The IdP then sends response to the SP with a token for that user.

To go through this guide, you’ll need the following. So load up, and let’s get poppin’

1. A Salesforce login. First create a trial Salesforce developer account. 
2. A VMware Identity Manager tenant at your disposal.

 

Now SAML can be explained as a way of making two parts speak the same language.

So what we are going to do now is:

Export the SAML Metadata from VMware Identity Manager

1. Log on to your VMware Identity Manager-tenant (URL: mXXXXXX.vmwareidentity.eu/)
2. 
3. Right-click “Identity Provider (IdP) metadata” and choose “Save link as..“
4. Save the metadata file (idp.xml).

 

Add application from the catalog

 

Import the SAML Metadata File to Salesforce

1. Now let’s start off by navigating to https://login.salesforce.com
2. Enter your Salesforce username and password and hit “Login”.
3. Type in “single” to find the SSO setting we will be configuring.
   
4. Choose “Edit” and Select “SAML Enabled” to enable SSO with the SAML protocol.
5. Choose “New from Metadate File”
   
   
6. Now we upload the idp.xml that we downloaded from our VMware Identity Manager tenant. Hit “Create” and the SAML SSO settings will populate.
7. Now we need to update the SAML Settings.  First off Select “Assertion contains the Federation ID from the User object.” and hit “Save”.
8. Hit “Download Metadata”.
9. Save the file it’ll be a .xml with a name similar to SAMLSP-XXDXXXXXXXXQ.xml.

 

Register your domain on Salesforce

Now that we’ve downloaded the SAML metadata file, we need to register our domain.

In the search box on the left, we will enter “my domain” and click “My Domain”.

 

1. In the field “Choose Your Domain Name”, enter a domain name.
2. To confirm that it is available, hit “Check Availability.”
3. Finish with hitting “Register Domain.”

Now we wait for an e-mail from Salesforce, that the domain is ready.

 

And after a few minutes:

Now we return to “My Domain”, and edit the authentication configuration.

1. In the search box on the left enter “my domain” and click “My Domain“.
2. Next to “Authentication Configuration, hit “Edit“. 

 

That concludes part one!

If there are any topics or areas you’d like me to focus on, don’t hesitate to let me know! As always you can reach me at @UlvBjornsson, via the comments or by connecting with me on LinkedIn.