Salesforce Single Sign-On

Set up Salesforce

To use Salesforce as your IdP, you will first need to register an OAuth application with your Salesforce tenant. This guide will walk you through the most basic setup via the "Salesforce Classic Experience".

1. In the Setup page, under Build click the dropdown next to Create and select Apps.

2. Under Connected Apps at the bottom of the page, click on New at the top.

3. Fill in the following fields with whichever values you want:

   • Connected App Name
   • API Name
   • Contact Email

4. Under API (Enable OAuth Settings) check the box next to Enable OAuth Settings.

5. Fill in the Callback URL section with https://{{AMBASSADOR_HOST}}/.ambassador/oauth2/redirection-endpoint.

6. Under Selected OAuth Scopes you must select the openid scope value at the minimum. Select any other scope values you want to include in the response as well.

7. Click Save and Continue to create the application.

8. Record the Consumer Key and Consumer Secret values from the API (Enable OAuth Settings) section in the newly created application's description page.

After waiting for salesforce to register the application with their servers, you should be ready to configure Ambassador Edge Stack to Salesforce as an IdP.

Set up the Ambassador Edge Stack

After configuring an OAuth application in Salesforce, configuring Ambassador Edge Stack to make use of it for authentication is simple.

1. Create an OAuth Filter with the credentials from above:

   yaml

   copied

   apiVersion: getambassador.io/v2
   kind: Filter
   metadata:
     name: salesforce
   spec:
     OAuth2:
       # Salesforce's generic OpenID configuration endpoint at https://login.salesforce.com/ will work but you can also use your custom Salesforce domain i.e.: http://datawire.my.salesforce.com
       authorizationURL: https://login.salesforce.com/
       # Consumer Key from above
       clientID: {{Consumer Key}}
       # Consumer Secret from above
       secret: {{Consumer Secret}}
       # The protectedOrigin is the scheme and Host of your Ambassador endpoint
       protectedOrigins:
       - origin: https://{{AMBASSADOR_HOST}}

2. Create a FilterPolicy to use the Filter created above

   yaml

   copied

   apiVersion: getambassador.io/v2
   kind: FilterPolicy
   metadata:
     name: oauth-policy
   spec:
     rules:
         # Requires authentication on requests from any hostname
       - host: "*"
         # Tells Ambassador Edge Stack to apply the Filter only on request to the quote /backend/get-quote/ endpoint
         path: /backend/get-quote/
         # Identifies which Filter to use for the path and host above
         filters:
           - name: salesforce
           # Any additional scope values granted in step 6 above can be requested with the arguments field
           #  arguments:
           #    scope:
           #    - refresh_token

3. Apply both the Filter and FilterPolicy above with kubectl

   Terminal

   copied

   kubectl apply -f salesforce-filter.yaml
   kubectl apply -f oauth-policy.yaml

Now any requests to https://{{AMBASSADOR_URL}}/backend/get-quote/ will require authentication from Salesforce.