Background

Integrating Salesforce with single sign-on (SSO) is a multi-step process using the SAML protocol. You will need to establish a custom domain in Salesforce, generate a self-signed certificate, and coordinate with the CalNet team to establish a trusted relationship between your Salesforce org and the CalNet system.

Part 1: Establish a custom "My Domain" in Salesforce

A custom subdomain allows you to better manage login authentication and brand your org (e.g., https://berkeley-department.my.salesforce.com). These steps assume you have administrator access to Salesforce.

1. From Setup, enter "My Domain" in the Quick Find box, then select My Domain.

   

2. Select Edit next to My Domain Details.
3. Enter your desired subdomain name. It can include up to 40 letters, numbers, and hyphens.

   

4. Click Check Availability, then click Register Domain.
5. You will receive an email when your domain is ready for testing.

Test and Deploy Your Domain

1. Log in via the link in the Salesforce confirmation email, or return to the My Domain setup page.
2. Verify that the URL in your browser address bar reflects the new subdomain.
3. Check your UI for "hard-coded references" (links pointing to old instances like na1.salesforce.com) and update them.
4. Once verified, click Deploy to Users.

Part 2: Generate a Self-Signed Certificate

Salesforce requires a specific certificate container format. If you do not feel comfortable with the command line, reach out to CalNet for help during your service request.

1. Ensure Java is installed to access the keytool application.
2. Run the following command, replacing the alias name with a unique identifier (no spaces or special characters):

   keytool -genkeypair -keyalg RSA -keysize 4096 -validity 3650 -alias mysalesforcesite -keystore keystore.jks -storetype jks
   

3. Set a strong keystore password and store it securely.
4. When prompted for "first and last name," enter the alias used in step 2. You may fill out the OU (IT), Org (UC Berkeley), and Location (Berkeley, CA, US) as prompted.
5. When prompted for a "key password," simply press RETURN (leave it the same as the keystore password).
6. Login to your Salesforce Service Console, click the Gear Icon, and select Setup.
7. Navigate to Settings > Security > Certificate and Key Management.
8. Select Import from Keystore. Select your keystore.jks file, enter your password, and click Save.

Part 3: Add Single-Sign Configuration to Salesforce

1. Go to Setup > Settings > Security > Remote Site Settings.
2. Select New Remote Site and enter:
   • Name: Production_IDP_Metadata_CalNet
   • URL: https://mdq.incommon.org/entities/urn:mace:incommon:berkeley.edu
   • Active: Checked
3. In Quick Find, search for Single Sign-On Settings. Click New from Metadata URL.
4. Enter the InCommon URL from step 2 and click Create.
5. On the settings page, configure the following:

Click Save, then select Download Metadata. Keep this file for Part 4.

Part 4: Request SSO Integration from CalNet

1. Open an SSO Service Request in ServiceNow.
2. Select "New SSO integration".
3. Choose SAML as the protocol and provide your Entity ID.
4. Attach the **XML Metadata** file you downloaded at the end of Part 3.

Part 5: Enable CalNet Authentication

1. In Salesforce, return to My Domain setup.
2. Scroll to Authentication Configuration and click Edit.
3. Check the box next to CalNet SSO. (Keep "Login Page" active for now while testing).
4. Click Save.

Part 6: Map Users (UIDs)

1. Gather the UIDs for users who need access from directory.berkeley.edu.
2. In Salesforce, go to Setup > Administration > Users > Users.
3. Edit a user and paste their UID into the Federation ID field under Single Sign-On Information.
4. Click Save.

Part 7: Finalize and Enforce SSO

1. Return to My Domain > Authentication Configuration > Edit.
2. Uncheck Login Form and click Save. CalNet will now be the only login option for your users.