Enable Salesforce Users for Single Sign-On (SSO)

The target Salesforce user accounts that will be enabled for Riva SSO must be granted a special SSO-related permission.  This is done by enabling the required permission in Salesforce user profiles and/or permission sets that the user will be assigned to.  Once users are added to an SSO-enabled user profile or permission set, their Salesforce login will change to use their Exchange account password.

Because organizations may not want to enable all of their Salesforce users for SSO, the best practise is to "clone" existing user profiles and enable those cloned profiles for SSO, or create and enable permission sets for SSO.  This article discusses:

• Requirements
• Options for enabling SSO for users
• How to create and configure a permission set
• Assign Users to an SSO-enabled permission set
• How to clone a user profile
• Enable the user profile for SSO
• Assign users to an SSO-enabled user profile

Requirements

Ensure that the following requirements are met before enabling Salesforce users for SSO:

• The DA-SSO feature has been activated in the target Salesforce organization.
• Salesforce Network Trust has been configured for the hosted SSO Provider service - for Hosted SSO Provider setup only.
• Salesforce Network Trust has been configured for the Riva server.
• The Generated SSO URL has been activated in the hosted Riva SSO Provider service - for Hosted SSO Provider setup only.

Options for enabling SSO for Salesforce Users

Enabling SSO involves checking the "Is Single Sign-on Enabled" permission against a user profile or a permission set.  If a user is assigned to an SSO-enabled user profile or permission set, Salesforce will pass all authentication requests to the DA-SSO gateway URL.

Deciding which option to use depends on how Salesforce user accounts will be enabled for SSO:

• Use a Permission Set:

  • when you need to enable Salesforce users on an individual one-by-one basis, or
  • if Riva needs to sync a Salesforce user that is assigned to the System Administrator user profile.

• Use a User Profile when you need to bulk enable a group of users:

  • you can enable an existing user profile for SSO, or
  • you can clone an existing profile, enable the cloned user profile for SSO, and move users into the cloned SSO-enabled user profile when you need to enable their Salesforce accounts for SSO.

How to create and configure a Permission Set

To create and configure a permission set for SSO:

1. Log in to the Salesforce.com organization using an admin account.

2. Select Setup > Administration Setup > Manage Users > Permission Sets.

3. Select New.

4. Complete the online form.  Ensure that you select the same license type that will be assigned to the users. Save the permission set.
   
   

5. In the Permission Sets list, select the name of the permission set to edit it.

6. On the Permission Set Overview page, scroll down, and select System Permissions.

7. In the System Permissions section, select Edit.

8. Check the Is Single Sign-On Enabled permission check box, and select Save.
   
   

Assign Users to a Permission Set

To assign Salesforce users to a permission set:

• Do one of the following:
  • On the Permission Set Overview page, select Assigned Users, or
    
    
  • On the user's page, under Manage Users, select Edit Assignments.
    
    

How to clone a User Profile

As a best practise, we recommend creating a clone of existing user profiles for SSO-enabled users:

To clone a user profile:

1. Log in to the Salesforce.com organization using an admin account.

2. Select Setup > Administration Setup > Manage Users > Profiles.

3. Select New.

4. On the Existing Profile drop-down list, select the desired source user profile.
   

5. Provide a profile name that clearly indicates it is for SSO-enabled users.
   

6. Select Save, and read the confirmation page that appears.
   

How to enable a User Profile for SSO

To enable a user profile for SSO:

1. Select Setup > Administration Setup > Manage Users > Profiles.

2. Beside the desired profile, select Edit.

3. Scroll down to General User Permissions, and check the Is Single Sign-on Enabled permission check box.
   
   

4. Save the user profile.

Assign users to an SSO-enabled User Profile

You can assign Salesforce users to a user profile from the Profile Detail page or from a user's page under Manager Users. For more information, see the following procedures.

To assign users on the Profile Detail page to an SSO-enabled user profile:

1. On the Profile Detail page for the desired profile, select View Users.

   

2. In the user list, select New User or Add Multiple Users.

   

To assign a user from the user's page to an SSO-enabled user profile:

1. On the user's page under Manage Users, select Edit.

2. On the Profile drop-down list, select an SSO-enabled profile.