Organizations that integrate single sign-on (SSO) with Salesforce using IBM Verify Access can enhance both security and user efficiency. IBM Verify Access provides a robust identity management platform that centralizes authentication and simplifies access to Salesforce and other applications.

SSO enables users to access Salesforce and other integrated applications with a single set of credentials, eliminating the need to remember and manage multiple passwords. It not only simplifies the user experience but also reduces the risk of password-related security breaches.

What is IBM Verify Access?

IBM Security Verify Access is a complete authorization and network security policy management solution. It provides end-to-end protection of resources over geographically dispersed intranets and extranets. IBM Security Verify Access offers the following features:

Authentication: Provides a wide range of built-in authenticators and supports external authenticators.
Authorization: Provides permit and deny decisions for protected resources requests in the secure domain through the authorization API.
Data security and centralized resource management: Manages secure access to private internal network-based resources by using the public internet's broad connectivity and ease of use with a corporate firewall system.

What is Salesforce?

Salesforce is a cloud-based application that provides a suite of tools for managing customer relationships, sales, marketing, and other business functions. Its core product is the Salesforce Customer Relationship Management (CRM) platform, which helps businesses track and manage interactions with customers, streamline sales processes, and analyze data to make informed decisions.

Learning objectives

In this tutorial, you will set up the IBM Verify Access appliance as a SAML Identity Provider (IdP), providing single sign-on authentication to Salesforce with JIT provisioning disabled.

Prerequisites

IBM Security Verify Access instance with Reverse Proxy configured (Note: This tutorial is based on IBM Security Verify Access v10.0.8.0)
Salesforce tenant (Sign up for a free account)
SSL certificates uploaded in Verify Access (default certificates available in Verify Access can also be used)

Steps

Step 1. Configuring IBM Access Manager as a SAML 2.0 Identity Provider

You first need to create the SAML 2.0 Quick Connect Identity Provider (IdP) federation. You’ll start by creating a Quick Connect federation in Verify Access, which supports configuration using partner defined templates.

On the Verify Access management console, go to Federation > Federations.
To add a new federation, click Add.
Enter a name to identify the federation and select the SAML 2.0 protocol. Click Next.
On the Template tab, select Quick Connect and then click Next.
In the Point of Contact field, enter the hostname/IP configured for the reverse proxy in the format https:///isam and then click Next.
On the Signature Options and Encryption Options tabs, select the Certificate Database and Label for your configuration and then click Next. Note: For testing and learning purposes, if you don’t have a certificate database, use the default database pdsrv and label WebSEAL-Test-Only.
The summary tab provides a summary of the configuration set so far. Click OK to complete the first part of the setup.
A notification banner displays at the top of the console. Click Review Pending Changes and then on the next tab click Deploy to implement the changes.

Note that the new federation now appears in the Federation Management list.

You now need to download the SSL certificate used in the previous steps for uploading to Salesforce:

On the Verify Access management console, under Secure Settings, select System > SSL Certificates.
Select the Certificate Database that you used, click Manage, and then select Edit SSL Certificate Database.
On the Personal Certificates tab, select the label file that you used.
Click Manage and then click Export.

The certificate file will be downloaded. Be sure to save this file because you will use it later in the configuration.

Step 2. Configuring the reverse proxy as a point of contact for federation

You will now configure the reverse proxy instance running on the Verify Access appliance as a point of contact for the Quick Connect federation created previously:

In the Verify Access management console, go to Web > Reverse Proxy.
Select the pre-configured reverse proxy instance. On the Manage tab, select AAC and Federation Configuration > Federation Management.
On the Federation Management page, click Add. A window named "Add Federation to Reverse Proxy – [Reverse Proxy Instance name]" is displayed. Keep the default selections.
Click the Federation tab, select the federation that you created as part of the first step, and then click Finish.
Close the Federation Management window and deploy the changes by following the instructions in the banner notification at the top of the console. Note: A warning message displays prompting you to restart the reverse proxy.
Select the reverse proxy instance and click the :fa-power-off: Restart button.

Step 3. Configure the IBM Access Manager and Salesforce integration

To configure Access Manager and add Salesforce as a federation partner in Verify Access, complete the following steps:

In the Verify Access management console, go to Federation > Federations.
Select the federation that was created as part of the first step and click Partners.
Click Add to add a new partner. In this case, you’ll add Salesforce.
Enter a name to identify the partner and select the Enabled checkbox.
In the Connection Template’s filter field, type Salesforce and select Salesforce as a SAML 2.0 Service provider with JIT Provisioning disabled. Click Next. Note: If you do not see any partner templates listed, review Managing federation partner templates in the IBM Security Verify Access documentation. Note: This tutorial uses “Salesforce SAML with JIT Disabled,” which means for the authentication to work, you should have a user account active in both Verify Access and Salesforce.
On the Single Sign-on Settings page, for Provider ID and Assertion Consumer Service URL, enter the URL of your Salesforce tenant and then click Next.
For Signature Options, you need to select an SSL certificate obtained from Salesforce. You will complete this step in a later configuration stage so for now, select any available certificate.
Click Next until you reach the Summary page.
On the Summary page, click OK to create the federation partner. Verify that the partner has been added successfully.
Close the Partners window and deploy the changes.

Step 4: Create the SAML single sign-on definition in Salesforce

You will now enable SAML SSO in Salesforce and configure it as a Service Provider:

In the Salesforce admin console’s left menu, go to Settings > Identity > Single Sign-On Settings.
Check to ensure that the Federated Single Sign-On Using SAML section is displaying SAML Enabled. If it is not enabled, click Edit and enable it.
In the SAML Single Sign-On Setting section, click New.
Enter the details on the new page as follows:
- Name: Provide a name to identify the IdP.
- Issuer: Enter in the following format: <https: /isam/sps/[Federation Name]/saml20
- Identity Provider Certificate: Upload the certificate file that you downloaded earlier.
- Entity ID: URL of your Salesforce tenant.
Click Save. A summary page is displayed.
On the summary page, click the value in the Request Signing Certificate field.
On the Certificate page, click Download Certificate. The Salesforce certificate is downloaded. You will update the partner federation with the certificate in Verify Access.
Go to Settings > Identity > Single Sign-On Settings. The new entry is listed under SAML Single Sign-On Setting.
Go to Settings > Company Settings > My Domain, scroll to the Authentication Configuration section and click Edit. You will see the new SAML connection configured.
Select the checkbox and click Save. The new sign-in method will now be available on the Salesforce log-in page.

Step 5: Upload the Salesforce SSL certificate

You will now upload the Salesforce SSL certificate to the Verify Access partner federation:

On the Verify Access management console, under Secure Settings, go to System > SSL Certificates.
Select the certificate database that was used, click Manage, and then select Edit SSL Certificate Database.
On the Signer Certificate tab, click Manage and select Import.
Upload the certificate that you downloaded previously (in step 4, no. 7) and enter a name to identity the certificate.
Go to Federation > Federations.
Select the federation that you created to integrate Salesforce, and then select Partners.
In the Partners window, select the Salesforce partner and then click Edit.
On the Signature Options tab, select the certificate database and label for the Salesforce certificate that you just added to Verify Access.
Click Next until you reach the Summary tab. Click OK to complete the setup.
Deploy the changes by following the instructions in the banner notification on the console.

You have now completed single sign-on integration of Verify Access and Salesforce. You can test the integration by logging into Salesforce using the Verify Access option to ensure it is working as expected.

Summary

In this tutorial, you've learned how to integrate single sign-on (SSO) with Salesforce using IBM Verify Access. This integration will help you prevent malicious actors from gaining access to your Salesforce implementation.

Next steps

To learn more about Verify Access, review the product IBM Security Verify Access documentation.

Check out our latest articles, tutorials, and blog posts related to security. Visit the IBM Developer Security hub, browse the latest content, and be sure to click Follow so you don't miss a thing.

Secure your Salesforce implementation with SSO using IBM Verify Access

Secure your Salesforce implementation with SSO using IBM Verify Access