Single Sign-On with Salesforce

Set up Salesforce

To use Salesforce as your IdP, you will first need to register an OAuth application with your Salesforce tenant. This guide will walk you through the most basic setup via the "Salesforce Classic Experience".

1. In the Setup page, under Build click the dropdown next to Create and select Apps.

2. Under Connected Apps at the bottom of the page, click on New at the top.

3. Fill in the following fields with whichever values you want:

   • Connected App Name
   • API Name
   • Contact Email

4. Under API (Enable OAuth Settings) check the box next to Enable OAuth Settings.

5. Fill in the Callback URL section with https://{{AMBASSADOR_HOST}}/.ambassador/oauth2/redirection-endpoint.

6. Under Selected OAuth Scopes you must select the openid scope value at the minimum. Select any other scope values you want to include in the response as well.

7. Click Save and Continue to create the application.

8. Record the Consumer Key and Consumer Secret values from the API (Enable OAuth Settings) section in the newly created application's description page.

After waiting for salesforce to register the application with their servers, you should be ready to configure Ambassador Edge Stack to Salesforce as an IdP.

Set up Ambassador Edge Stack

After configuring an OAuth application in Salesforce, configuring Ambassador Edge Stack to make use of it for authentication is simple.

1. Create an OAuth Filter with the credentials from above:

2. Create a FilterPolicy to use the Filter created above

3. Apply both the Filter and FilterPolicy above with kubectl

Now any requests to https://{{AMBASSADOR_URL}}/backend/get-quote/ will require authentication from Salesforce.