Salesforce as a SAML Identity Provider

To add Salesforce as a SAML 2.0 external integration, you must create a connected app with SAML configuration in the Salesforce organization to enable trust with the service provider (Conga Auth Service). After creating the app, you need external_organization_id, Metadata Location URL, and Organization ID Claim Type details.

To set up Salesforce as a SAML identity provider, enable your organization as an identity provider and integrate your service provider as a connected app.

Step 1: Enable identity provider setting

Log in to Salesforce.
Go to Setup, then search and select Identity Provider.
Click Enable Identity Provider.
Select the self-signed certificate from the dropdown menu.
Click Save.

Step 2: Enable single sign-on setting

Search and select Single Sign-On Settings.
Click Edit.
Check the SAML Enabled checkbox.
Click Save.

Step 3: Create a SAML-enabled connected app

Search and select App Manager.
Click New Connected App.

Enter the following details in the Basic Information section:


Field	Description
Connected App Name	Enter the connected app’s name, which is displayed in the App Manager.
API Name	The API name is generated automatically based on the name of the Connected App.
Contact Email	Enter the email address of the administrator managing the Connected App.

Fill in the following details in the Web App Settings section. Leave the other field as is.


Field	Description
Enable SAML	Select the Enable SAML checkbox.
Entity Id	The globally unique ID of the service provider. Enter the following URL per your environment: Preview environment: https://login-rlspreview.congacloud.com/api/v1/auth Production environment: https://login-rls.congacloud.com/api/v1/auth
ACS URL	(Assertion Consumer Service) The service provider’s endpoint that receives SAML assertions. Enter the following URL per your environment: Preview environment: https://login-rlspreview.congacloud.com/api/v1/auth/Saml2/Acs Production environment: https://login-rls.congacloud.com/api/v1/auth/ Saml2/Acs
Name ID Format	Specify the email address as the format attribute sent in SAML messages.
Singing Algorithm for SAML Messages	Select the SHA256 option.

Click Save.
Open the connected app that is created for the SAML identity provider.
Click Edit Policies.
Go to the Custom Attributes section and make sure to add the custom attribute with the external_organization_id as an attribute key and the organization ID as an attribute value.
Click Save.
Go to the User Accounts section and add a user account.
Go to the Profiles and Permission Sets sections and add profiles and permission sets to provide connected app access to Salesforce users.

With setup complete, you must get the information needed to configure an external integration.

Step 4: Get the external_organization_id and Metadata Location URL details

Search and select Manage Connected Apps.
Open the connected app that is created for the SAML identity provider.
Go to the Custom Attributes section and make sure the custom attribute is created with the external_organization_id as an attribute key and the organization ID as an attribute value.
Go to the SAML Login Information section.
Copy the Metadata Discovery Endpoint which is the metadata location URL.
Note:
- To use Salesforce as an SSO, use the organization's metadata discovery endpoint.
- To use Salesforce Community as an SSO, use the Community's metadata discovery endpoint.

Step 5: Add Salesforce as an external integration

Log in to the Conga Advantage Platform as an admin user.
Click the App Launcher () icon from the top-left corner > Admin Console > Organization.
Go to the External Integrations tab.
Click Add New and choose the SAML 2.0 from the list.
The Add New External Integration screen appears.

Enter values in the following fields as per your SAML 2.0 external integration:


Field	Description
Choose IDP Metadata Setup	You can either enter the metadata location URL or upload the XML file. URL Input: Select this option and enter the Metadata Discovery Endpoint that you copied in Step 4. XML File Upload: Select this option and upload your metadata XML file.
External Organization ID	Enter the Salesforce Organization ID (18 digits). For more information on how to get the 18-digit organization ID, see Getting Salesforce Organization ID.
Type	Enter the type of this integration. It is a free-form text field. You can add types such as Dev, QA, UAT, Prod, etc.
Organization ID Claim Type	Leave this field blank.
Description	Add the description.
Email Domain	Enter the email domain you want to associate with designated IdP. It can be added for administrative purposes.
Display Name	Enter the display name for the identity provider.
Default IDP	Enable the toggle to make it a Default External Integration IdP. A user will be created for the external integration set as the Default IdP for the organization. For example, if you have set Salesforce, a SAML Identity Provider, as the Default IdP, all the new users will be created with the Salesforce IdP.

Click Save.

You can edit the external integration. Perform the following steps to edit the existing external integration:

Click the More () icon and select Edit.
Update the Choose IDP Metadata Setup, External Organization ID, Type, Description, Email Domain, Display Name, and Default IDP fields per your business needs.

Note: You should change the External Organization ID if the Single Sign-On (SSO) external ID changes.

Conga Product Documentation

Welcome to the new doc site. Some of your old bookmarks will no longer work. Please use the search bar to find your desired topic.