Skip to main content
GruposSalesforce IdentityPergunta de Christopher Mair
Christopher Mair (Shift7) perguntou em Salesforce Identity
25 de ago. de 2021, 17:49

Bi-directional SSO between two communities in same org with custom domains?

Hi @Salesforce Identity I have an org with two communities that are on custom domains.  A user needs to be able to access the uniquely branded login page for both sites, but once authenticated in one, switch to the other without re-authenticating.  I'm assuming there is a way to set this up with SSO / Connected Apps?  Any guidance would be appreciated.  Thanks!

 

Chris

 

#Experience Cloud

7 respostas
  1. Christopher Mair (Shift7)
    13 de out. de 2021, 00:32

    I wanted to post the solution for this in case anyone else encounters it.  The requirement here is two Salesforce Experience Sites on custom domains that need SSO but also individual login pages.  Some users access only one site and those who access both may prefer to normally log in to one or the other.

     

    Login Component - Customized OOTB Aura component contextually aware to which experience site it's being loaded on.

     

    Here is the real trick:

     

    1. Download Metadata and Cert from Identity Provider section of Setup 
    2. Create two SSO Setting Records from Identity Provider metadata (create the records skipping step 1.1, return after creating the connected apps)
      1. Site1ToSite2SSO
        1. Identity Provider Login URL is the Site1ToSite2SSO Connected App SAML Endpoint for the Site1 community 
        2. SAML Identity Type User ID
        3. SAML Identity Location Attribute
        4. SAML Attribute Name userId
        5. Binding HTTP Redirect
      2. Site2ToSite1SSO
        1. Entity Id needs to be unique and needs to be the same in the connected app.
        2. Identity Provider Login URL is the Site2ToSite1SSO Connected App SAML Endpoint for the Site2 community 
        3. SAML Identity Type User ID
        4. SAML Identity Location Attribute
        5. SAML Attribute Name userId
        6. Binding HTTP Redirect
    3. Create two Connected Apps
      1. Site1ToSite2SSO
        1. Single Logout URL is the login page of the Site2 community 
        2. ACS URL is the Site1ToSite2SSOSingle Sign on SAML Endpoint for the Site2 community 
        3. StartURL is the home page of the Site2 community 
        4. Subject Type Username
      2. Site2ToSite1SSO
        1. Single Logout URL is the login page of the Site 1 community
        2. ACS URL is the Site2ToSite1SSO Single Sign on SAML Endpoint for the Site1 community 
        3. StartURL is the home page of the Site1 community 
        4. Subject Type Username
    4. Links to use to navigate
      1. GotoSite1- The IdP-Initiated Login URL from the Site2ToSite1 connected app for the Site2 Community.
      2. GotoSite2- The IdP-Initiated Login URL from the Site1ToSite2 connected app for the Site1 Community.
Escrever uma resposta...
0/9000