3 min • read

Single Sign-On with Salesforce

Set up Salesforce

To use Salesforce as your IdP, you will first need to register an OAuth application with your Salesforce tenant. This guide will walk you through the most basic setup via the "Salesforce Classic Experience".

  1. In the Setup page, under Build click the dropdown next to Create and select Apps.

  2. Under Connected Apps at the bottom of the page, click on New at the top.

  3. Fill in the following fields with whichever values you want:

    • Connected App Name
    • API Name
    • Contact Email
  4. Under API (Enable OAuth Settings) check the box next to Enable OAuth Settings.

  5. Fill in the Callback URL section with https://{{AMBASSADOR_HOST}}/.ambassador/oauth2/redirection-endpoint.

  6. Under Selected OAuth Scopes you must select the openid scope value at the minimum. Select any other scope values you want to include in the response as well.

  7. Click Save and Continue to create the application.

  8. Record the Consumer Key and Consumer Secret values from the API (Enable OAuth Settings) section in the newly created application's description page.

After waiting for salesforce to register the application with their servers, you should be ready to configure Ambassador Edge Stack to Salesforce as an IdP.

Set up Ambassador Edge Stack

After configuring an OAuth application in Salesforce, configuring Ambassador Edge Stack to make use of it for authentication is simple.

  1. Create an OAuth Filter with the credentials from above:

    apiVersion: getambassador.io/v3alpha1
    kind: Filter
    name: salesforce
    # Salesforce's generic OpenID configuration endpoint at https://login.salesforce.com/ will work but you can also use your custom Salesforce domain i.e.: http://datawire.my.salesforce.com
    authorizationURL: https://login.salesforce.com/
    # Consumer Key from above
    clientID: {{Consumer Key}}
    # Consumer Secret from above
    secret: {{Consumer Secret}}
    # The protectedOrigin is the scheme and Host of your Ambassador Edge Stack endpoint
    - origin: https://{{AMBASSADOR_HOST}}
  2. Create a FilterPolicy to use the Filter created above

    apiVersion: getambassador.io/v3alpha1
    kind: FilterPolicy
    name: oauth-policy
    # Requires authentication on requests from any hostname
    - host: "*"
    # Tells Ambassador Edge Stack to apply the Filter only on request to the quote /backend/get-quote/ endpoint
    path: /backend/get-quote/
    # Identifies which Filter to use for the path and host above
    - name: salesforce
    # Any additional scope values granted in step 6 above can be requested with the arguments field
    # arguments:
    # scope:
    # - refresh_token
  3. Apply both the Filter and FilterPolicy above with kubectl

    kubectl apply -f salesforce-filter.yaml
    kubectl apply -f oauth-policy.yaml

Now any requests to https://{{AMBASSADOR_URL}}/backend/get-quote/ will require authentication from Salesforce.