{"id":4516,"date":"2015-05-29T15:09:49","date_gmt":"2015-05-29T15:09:49","guid":{"rendered":"http:\/\/www.jitendrazaa.com\/blog\/?p=4516"},"modified":"2017-10-03T00:02:46","modified_gmt":"2017-10-03T00:02:46","slug":"login-to-salesforce-from-salesforce-using-authentication-provider","status":"publish","type":"post","link":"https:\/\/www.jitendrazaa.com\/blog\/salesforce\/login-to-salesforce-from-salesforce-using-authentication-provider\/","title":{"rendered":"Login to Salesforce from Salesforce using Authentication Provider"},"content":{"rendered":"

There are many ways to login to your Salesforce instance, using Google, Facebook, Linked, Twitter and even from other Salesforce Organization. I am sure many of readers has multiple Salesforce instances and its hard to remember password of each. We can connect every Salesforce instances and login using only one. In this post we will see, how we can login to one Salesforce from other using built in Authentication provider<\/a> from Salesforce.<\/p>\n

Throughout this article I will use term “service provider\u00a0Salesforce instance<\/em>” for Organization where I need to go after login and “Authentication Provider instance<\/em>” which will authenticate user and will act as source organization for login.<\/p>\n

Enable MyDomain\u00a0<\/strong><\/p>\n

First step to start with Authentication Provider is to setup my domain<\/a> in your “service provider\u00a0Salesforce instance<\/em>“. This step is important so that it will display all available Authentication provider for that Salesforce instance.<\/p>\n

Create Connected app\u00a0<\/strong><\/p>\n

If you want to login from Facebook, LinkedIn or any other web application, you need to inform Salesforce that those applications are legitimate and this is very important piece of OAuth2. One of major difference between OAuth1 and OAuth2<\/em><\/span> is that OAuth2 provides scope where you can set what specific permission\u00a0this Connected App will need.<\/p>\n

Connected App also has “Consumer Key” and “Consumer Secret” which is equivalent to “username” and “password” for that App.<\/p>\n

Other important setting, connected app has “Callback URL<\/em>“. This is the URL where “Authentication Provider instance<\/em>” should return after providing access. Even if somehow “Consumer Key” and “Consumer Secret” is compromised, it will return to Callback URL which is your application.<\/p>\n

<\/p>\n

In this post we need “service provider\u00a0Salesforce instance<\/em>” to be logged in from “Authentication Provider instance<\/em>“. So “Authentication Provider instance<\/em>” should\u00a0be able to identify that request is coming from “service provider\u00a0Salesforce instance<\/em>“. Therefore Connected App needs to be created in “service provider\u00a0Salesforce instance<\/em>” (SP).<\/strong><\/p>\n

To create Connected App in “service provider\u00a0Salesforce instance<\/em>“, Navigate to “Setup | Build | Create | Apps | Connected Apps” and click on New. Provide All information except “Callback URL”. We will comeback again on this step later to provide Callback URL.<\/p>\n

\"Salesforce<\/a>
Salesforce Connected App<\/figcaption><\/figure>\n

Once you save this Connected app, it will provide “Consumer Key” and “Consumer Secret”, we need this information in next step.<\/p>\n

Create Authorization Provider\u00a0<\/strong><\/p>\n

Its time to create Authorization Provider in\u00a0“Authentication provider\u00a0Salesforce instance (IDP)”.<\/strong><\/p>\n

Navigate to “Setup | Administer | Security Controls | Auth. Providers | Create New”.<\/p>\n

Select “Salesforce” as provider Type.<\/p>\n

We need to provide “Consumer Key” and “Consumer Secret” created in previous step. Also one important setting is “Default Scope<\/a>“, it should have value as “refresh_token full”. “refresh_token” and “full” should be separated by space. Authorize Endpoint URL should be something like “https:\/\/AuthenticationProviderinstance\/services\/oauth2\/authorize<\/em><\/span>” and Token Endpoint URL “https:\/\/AuthenticationProviderinstance\/services\/oauth2\/token<\/em><\/span>“.<\/p>\n

Click on “Automatically create a registration handler template”, it will generate one apex class, in my case auto generated apex class name is “AutocreatedRegHandler1432826053915”. Then Select User who should be used to execute this Apex class when user tries to login.<\/p>\n

\"Salesforce<\/a>
Salesforce Authentication Provider<\/figcaption><\/figure>\n

Set Callback URL in Connected App\u00a0<\/strong><\/p>\n

Once you save “Auth. Provider” in previous step, it will provide you list of URL as shown in below image. Copy Callback URL and edit Connected App we created in\u00a0service provider\u00a0Salesforce instance<\/em><\/strong>\u00a0and set this URL.<\/p>\n

\"Salesforce<\/a>
Salesforce Authentication Provider Client Configuration<\/figcaption><\/figure>\n

you can even test your application using “Test-Only initialization URL”, however in our case we need to modify our Apex class, so need to wait.<\/p>\n

Create field in User Object\u00a0<\/strong><\/p>\n

We are almost there, but we have one problem to address. When someone tries to login from “Authentication Provider instance”, how we will match which user from “Authentication Provider instance”\u00a0matched with user in “service provider\u00a0Salesforce instance<\/em>” ? We will need to create one field on User object which will save username of other Salesforce instance. In this case, I have created field “Other Salesforce Org Username”. Once field is created, populate every user record so that we should be able to match them.<\/p>\n

Update Auto generated Registration Handler Apex class\u00a0<\/strong><\/p>\n

Replace content of Apex class by below code, in our case class name is “AutocreatedRegHandler1432826053915”.<\/p>\n

\r\n\/**\r\n*\t@Author\t\t\t:\tJitendra Zaa\r\n*\t@Date\t\t\t:\t5\/29\/2015\r\n*\t@Description \t:\tMatch User from Other Salesforce instance with this Salesforce.\r\n*\r\n**\/\r\nglobal class AutocreatedRegHandler1432826053915 implements Auth.RegistrationHandler{\r\n\t \/**\r\n\t *\tThis method is used to match existing user, If not find then we can create new User.\r\n\t *\tThis method will be executed only first time so that Salesforce can relate two users\r\n\t *\/\r\n\tglobal User createUser(Id portalId, Auth.UserData data){\r\n\t\tUser u = [SELECT ID FROM User Where Other_Salesforce_Org_Username__c = : data.username];\r\n\t\treturn u;\r\n\t}\r\n\r\n\t\/**\r\n\t*\tOnce Users are related, after that whenever user will return, this method wil be executed.\r\n\t*\tIf needed, we can perform any information needed.\r\n\t*\tIn this blog , we are not going to perform any operation in this method.\r\n\t*\/\r\n\tglobal void updateUser(Id userId, Id portalId, Auth.UserData data){\r\n\t   \/\/No Operation\r\n\t}\r\n}\r\n<\/pre>\n
As you can see, this class implements interface “Auth.RegistrationHandler” which has contract for two methods named “createUser” and “updateUser”, other piece of code is commented to explain.<\/p>\n
Add Salesforce button on Login Page\u00a0<\/strong><\/p>\n
Navigate to “Setup | Administer | Domain Management | My Domain | Authentication Configuration | Edit”.<\/p>\n
This page will provide, list of all Authentication providers like LinkedIn, Facebook, Google, In our case Salesforce.<\/p>\n
\"Salesforce<\/a>
Salesforce Authentication Configuration in My Domain<\/figcaption><\/figure>\n
Now logout and navigate to Login page specific to your instance and you should be able to see all Authentication provider buttons for your instance. Pleas note that, Authentication provider button will not appear on “https:\/\/login.salesforce.com<\/span><\/em>” page, it has to be Mydomain login URL.<\/p>\n
This is sample of Login page, how it will look like.<\/p>\n
\"Salesforce<\/a>
Salesforce My Domain Login page<\/figcaption><\/figure>\n","protected":false},"excerpt":{"rendered":"
There are many ways to login to your Salesforce instance, using Google, Facebook, Linked, Twitter and even from other Salesforce Organization. I am sure many of readers has multiple Salesforce instances and its hard to remember password of each. We can connect every Salesforce instances and login using only one. In this post we will […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"jz_research_post":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[9],"tags":[319,318,243,260,331],"class_list":["post-4516","post","type-post","status-publish","format-standard","hentry","category-salesforce","tag-authentication-provider","tag-login","tag-my-domain","tag-oauth","tag-salesforce"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":3830,"url":"https:\/\/www.jitendrazaa.com\/blog\/salesforce\/step-by-step-guide-to-setup-federated-authentication-saml-based-sso-in-salesforce\/","url_meta":{"origin":4516,"position":0},"title":"Step by step guide to Setup Federated Authentication (SAML) based SSO in Salesforce – Video Tutorial","author":"Jitendra","date":"April 14, 2014","format":false,"excerpt":"In this post, We will be dicussing how to setup\u00a0Federated SAML based Authentication in Salesforce. SAML stands for \"Security Assertion Markup Language\" and it is Open standard for exchanging Authentication and Authorization between Systems. SAML based authentication is supported by all editions of Salesforce. User Validation can be initiated by\u2026","rel":"","context":"In "Salesforce"","block_context":{"text":"Salesforce","link":"https:\/\/www.jitendrazaa.com\/blog\/category\/salesforce\/"},"img":{"alt_text":"Login using SAML Response from AXIOM","src":"https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2014\/04\/Login-using-SAML-Response-from-AXIOM.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2014\/04\/Login-using-SAML-Response-from-AXIOM.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2014\/04\/Login-using-SAML-Response-from-AXIOM.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2014\/04\/Login-using-SAML-Response-from-AXIOM.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":3872,"url":"https:\/\/www.jitendrazaa.com\/blog\/salesforce\/implement-saml-based-single-sign-on-sso-salesforce-as-identity-provider-idp-salesforce-as-service-provider-sp\/","url_meta":{"origin":4516,"position":1},"title":"Implement SAML based Single Sign On (SSO) | Using Salesforce as Identity Provider (Idp) as well as Service Provider (SP)","author":"Jitendra","date":"April 23, 2014","format":false,"excerpt":"Previously we have seen, How to setup SAML based Single Sign On Where Salesforce will be Service Provider and some other application like AXIOM will be Identity Provider. In this article we will use one Salesforce Instance as Identity Provider and other Salesforce Instance\u00a0as Service Provider. Before starting you have\u2026","rel":"","context":"In "Salesforce"","block_context":{"text":"Salesforce","link":"https:\/\/www.jitendrazaa.com\/blog\/category\/salesforce\/"},"img":{"alt_text":"User Setup in SSO Salesforce","src":"https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2014\/04\/User-Setup-in-SSO-Salesforce1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2014\/04\/User-Setup-in-SSO-Salesforce1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2014\/04\/User-Setup-in-SSO-Salesforce1.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":4632,"url":"https:\/\/www.jitendrazaa.com\/blog\/salesforce\/how-to-use-login-flow-in-salesforce\/","url_meta":{"origin":4516,"position":2},"title":"How to use Login Flow in Salesforce","author":"Jitendra","date":"July 7, 2015","format":false,"excerpt":"What is Login flow in Salesforce and how to solve common yet important problem using Salesforce declarative ability only.","rel":"","context":"In "Salesforce"","block_context":{"text":"Salesforce","link":"https:\/\/www.jitendrazaa.com\/blog\/category\/salesforce\/"},"img":{"alt_text":"Salesforce Login Flow Connection","src":"https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2015\/07\/Salesforce-Login-Flow-Connection.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2015\/07\/Salesforce-Login-Flow-Connection.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2015\/07\/Salesforce-Login-Flow-Connection.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":6455,"url":"https:\/\/www.jitendrazaa.com\/blog\/salesforce\/quick-summary-of-salesforce-identity-connect-capabilities\/","url_meta":{"origin":4516,"position":3},"title":"Quick Summary of Salesforce Identity Connect Capabilities","author":"Jitendra","date":"April 19, 2018","format":false,"excerpt":"Short & quick note about Salesforce Identity product","rel":"","context":"In "Salesforce"","block_context":{"text":"Salesforce","link":"https:\/\/www.jitendrazaa.com\/blog\/category\/salesforce\/"},"img":{"alt_text":"Salesforce Identity Connect","src":"https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2018\/04\/Salesforce-Identity-Connect.png?fit=1000%2C400&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2018\/04\/Salesforce-Identity-Connect.png?fit=1000%2C400&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2018\/04\/Salesforce-Identity-Connect.png?fit=1000%2C400&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2018\/04\/Salesforce-Identity-Connect.png?fit=1000%2C400&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":6554,"url":"https:\/\/www.jitendrazaa.com\/blog\/salesforce\/salesforce-single-sign-on-sso-using-janrain\/","url_meta":{"origin":4516,"position":4},"title":"Salesforce Single Sign On (SSO) using Janrain – Video","author":"Jitendra","date":"July 22, 2018","format":false,"excerpt":"How to use Facebook, Twitter, Wechat, Microsoft, Yahoo & many more as a Identity Provider for Salesforce with the help of Janrain Auth Provider - Video included","rel":"","context":"In "Salesforce"","block_context":{"text":"Salesforce","link":"https:\/\/www.jitendrazaa.com\/blog\/category\/salesforce\/"},"img":{"alt_text":"Janrain Salesforce Single Sign On Execution Flow","src":"https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2018\/07\/Janrain-SSO.png?fit=1200%2C572&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2018\/07\/Janrain-SSO.png?fit=1200%2C572&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2018\/07\/Janrain-SSO.png?fit=1200%2C572&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2018\/07\/Janrain-SSO.png?fit=1200%2C572&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2018\/07\/Janrain-SSO.png?fit=1200%2C572&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":4532,"url":"https:\/\/www.jitendrazaa.com\/blog\/salesforce\/salesforce-to-salesforce-integration-using-named-credentials-in-just-5-lines-of-code\/","url_meta":{"origin":4516,"position":5},"title":"Salesforce to Salesforce integration using Named Credentials in 5 lines","author":"Jitendra","date":"May 29, 2015","format":false,"excerpt":"I have already written article to integrate Salesforce with other Salesforce instance around 3 years back. In last 3 years, Salesforce has changed a lot. This time I will integrate Salesforce with other Salesforce only only in 5 lines of code, can you believe it \u00a0:) ? Check my old\u2026","rel":"","context":"In "Salesforce"","block_context":{"text":"Salesforce","link":"https:\/\/www.jitendrazaa.com\/blog\/category\/salesforce\/"},"img":{"alt_text":"Authenticated Named Credential in Salesforce","src":"https:\/\/i0.wp.com\/www.jitendrazaa.com\/blog\/wp-content\/uploads\/2015\/05\/Authenticated-Named-Credential-in-Salesforce.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]}],"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/www.jitendrazaa.com\/blog\/wp-json\/wp\/v2\/posts\/4516","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jitendrazaa.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jitendrazaa.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jitendrazaa.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jitendrazaa.com\/blog\/wp-json\/wp\/v2\/comments?post=4516"}],"version-history":[{"count":12,"href":"https:\/\/www.jitendrazaa.com\/blog\/wp-json\/wp\/v2\/posts\/4516\/revisions"}],"predecessor-version":[{"id":6296,"href":"https:\/\/www.jitendrazaa.com\/blog\/wp-json\/wp\/v2\/posts\/4516\/revisions\/6296"}],"wp:attachment":[{"href":"https:\/\/www.jitendrazaa.com\/blog\/wp-json\/wp\/v2\/media?parent=4516"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jitendrazaa.com\/blog\/wp-json\/wp\/v2\/categories?post=4516"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jitendrazaa.com\/blog\/wp-json\/wp\/v2\/tags?post=4516"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}