# OpenAM Administration Guide
Chapter 12. Managing SAML 2.0 Federation

Sidebar | Prev | Up | Next

## 12.7. Configuring Salesforce CRM as a Remote Service Provider

OpenAM can serve as the identity provider when you use Salesforce CRM as a service provider, allowing users to have single sign-on with their Salesforce CRM account.

In order to use this service, you must have Salesforce CRM accounts for your organization.

Procedure 12.11. To Integrate With Salesforce CRM

1. If you have not yet done so, set up OpenAM as described in Procedure 12.1, “To Create a Hosted Identity Provider”, using a signing certificate that is needed by Salesforce CRM.

   See the procedure To Change the Signing Key for Federation for details regarding the signing certificate.

2. On the OpenAM console Common Tasks page, click Configure Salesforce CRM.

3. Enter the EntityID for your Salesforce service provider.

   This ID is used as the persistent EntityDescriptor metadata element so that users can have multiple service provider instances. This field is used for the EntityDescriptor on the next page.

4. On the first Salesforce CRM Single Sign-On Configuration page, configure attribute mapping to associate the appropriate attribute from Salesforce CRM with the user profile attribute on your IDP.

   For example, add a mapping for `IDPEmail` to `mail`, and then click Create. Make sure the attribute mapper is sending the correct attribute to be used for the federated identity.

5. On the second Salesforce CRM Single Sign-On Configuration page, follow the instructions below before clicking Finish.

   1. In a new browser tab or window, login to Salesforce CRM with your administrator credentials.

      Create an administrator account if none exists, yet.

   2. If your users go directly to Salesforce to access services, then their single sign-on is SP-initiated from the Salesforce side. Salesforce provides a "My Domain" feature to facilitate SP-initiated single sign-on for desktop and device users.

      When you have completed configuring Salesforce as a service provider, users can then browse to your domain at Salesforce, such as `https://openam.my.salesforce.com`, and be redirected to OpenAM to authenticate before being redirected to Salesforce.

      1. Select Administration Setup > Company Profile > My Domain.

      2. Choose the domain name, and then register the domain.

      3. Wait until the domain is ready for testing to proceed.

   3. In Salesforce CRM, browse to Setup > Administration Setup > Security Controls > Single Sign-On Settings, and then click Edit for Single Sign-On Settings.

   4. Select SAML Enabled.

   5. Set the SAML Version to 2.0.

   6. Copy the issuer name from the OpenAM page to the Issuer field on the Salesforce CRM page.

   7. Copy or download the OpenAM verification certificate to a text file, such as `OpenAMCert.pem` or `OpenAMCert.txt`.

   8. Upload the certificate file as Identity Provider Certificate on the Salesforce CRM page.

   9. For SAML Identity Type in Salesforce CRM, choose Assertion contains the Federation ID from the User object.

   10. For SAML Identity Location in Salesforce CRM, choose Identity is in an Attribute element.

   11. If you require specific login or logout pages, enter them in the next two fields.

   12. Enter the URL of your page specific error page if you have a page where you would like users redirected to when they encounter an error.

   13. Copy the attribute name such as `IDPEmail` from the OpenAM page to the Attribute Name field on the Salesforce CRM page.

   14. Leave the NameID Format field empty.

   15. Select the Entity ID corresponding to the "My Domain" that you set up.

   16. Save your work in Salesforce CRM.

   17. Salesforce CRM displays a Salesforce Login URL.

       Copy the Salesforce Login URL to the field provided on the OpenAM page.

   18. Salesforce CRM returns to the Single Sign-On Settings form.

   19. Click Download Metadata to download the Salesforce CRM SP metadata.

       After you complete the configuration, you must import the SP metadata you download in this step.

   20. In Salesforce CRM, browse to Administration Setup > Manage Users, and then click Users.

   21. Add users as necessary, making sure the attribute chosen as the Federation ID matches the local attribute you mapped to the remote attribute in the previous page in OpenAM.

   22. Click Finish to complete the process.

6. After you finish, import the metadata for Salesforce CRM as SP.

   1. Browse in OpenAM console to the Federation tab.

   2. If the remote SP entity for Salesforce CRM is already in the Entity Providers list, delete the existing configuration.

   3. Click Import Entity..., and then use the Import Entity Provider page to import the Salesforce CRM metadata.

      - Update the `Realm Name` to the appropriate realm.

      - Select the location where the metadata file is.

      - Enter the path for the metadata file.

      - If you have an extended data file, select the location where the file is.

      - If you have an extended data file, enter the path for the metadata file.

   At this point, when a user browses to the Salesforce domain you set up, they should be redirected to OpenAM for authentication. Upon successful authentication, they should be logged in to Salesforce.