Salesforce Single Sign-On with Okta as IdP

Single Sign-On gives users a single set of credentials to access multiple applications, so they spend less time managing passwords.

Okta can be used as an identity provider (IdP) and Salesforce will be the service provider (SP). In the scope of this project, Salesforce is the service provider that uses a third party to authenticate access to it.

1. Configure the Okta side

1. Create a free developer account for Okta at developer.okta.com/signup.
2. Go to Browse App Catalog.
3. Select Salesforce.com.
4. Click Add Integration.
5. On the next screen, open the General Settings tab.
6. Go to your Salesforce org → Setup → My Domain. Copy the domain name and paste it back into the Okta setting.
7. Click Next.
8. On the Sign-on options tab select SAML 2.0.

2. Configure Salesforce SAML SSO

1. Go to Salesforce org → Setup → Single Sign-On Settings and enable SAML if it isn't already.
2. Click Save, then click New to create a new SSO record.
3. In a separate browser tab, open the Okta app's sign-on settings, scroll down and click View Setup Instructions. This page contains the values you need to feed into Salesforce.

Back in Salesforce, enter the following on the new Single Sign-On settings page:

• Name — a name of your choice.
• SAML Version — make sure this is set to 2.0 (default).
• Issuer — copy and paste from the Okta instructions (unique to you).
• Identity Provider Certificate — download from Okta, then upload it here.
• Identity Provider Login URL — copy and paste from Okta. This authenticates users when they log in directly to Salesforce or follow a deep link while unauthenticated. Required for SP-initiated SAML.
• Custom Logout URL — optional; copy from Okta if desired.
• API Name — an API name of your choice.
• Entity ID:
  • With a custom domain: https://[customDomain].my.salesforce.com
  • Without a custom domain: https://saml.salesforce.com

1. Click Save.
2. Back in Okta, provide the login URL from the Salesforce Single Sign-On screen, paste it into Okta settings and press Done.

3. Create the Connected App

1. In Salesforce, go to Setup → App Manager → New Connected App.
2. Enter the app name; the API name should generate automatically.
3. Enter a contact email (e.g. helpdesk or support). Salesforce uses this if they need to contact you about the connected app.
4. In the API (Enable OAuth Settings) section, set the Callback URL to https://system-admin.okta.com/admin/app/generic/oauth20redirect.
5. Select the OAuth scopes:
   • Manage user data via APIs (api)
   • Perform requests at any time (refresh_token, offline access)
6. Leave the other settings as-is and Save.

4. Enable API integration & provisioning in Okta

1. In Okta, go to the Salesforce app → Provisioning → Integration, then click Configure API Integration.
2. Check Enable API Integration.
3. Enter the OAuth Consumer Key and Consumer Secret from the Connected App.
4. Click Authenticate with Salesforce.com; on success, press Save.
5. Go to the To App (User Provisioning) tab. From the Okta → Salesforce flow, select Create Users and Deactivate Users (optionally Update User Attributes), then Save.

5. Make Salesforce the service provider

1. For SP-initiated flow, go to Salesforce → Setup → My Domain and scroll to Authentication Configuration. Select the single sign-on setting you created earlier.
2. Click Save — and you're done!

Notes & hardening

1. To enforce SSO, go to Setup → Single Sign-On Settings and check Disable login with Salesforce credentials.
2. To disable direct logins through login.salesforce.com / test.salesforce.com: in Setup, open My Domain, edit the Policies section and set the Login Policy to Prevent login from https://login.salesforce.com, then save.

   This disables the Salesforce login URL for every user. If you need admins to keep using it during a third-party outage, don't enable this — control it at the profile level instead.

3. To enable SSO at the profile level: Setup → Profiles, edit the profile, find Administrative Permissions, select Is Single Sign-On Enabled, then save.

References

• Salesforce SSO with Okta walkthrough (YouTube)

Originally published on Cloud Mesh by Mahmood.