Configure SAML with Salesforce

If you use Salesforce as your SAML identity provider (IdP), you can use the information in this document to set up SAML authentication for your LMS.

These steps assume that you have permissions for modifying your organization’s Salesforce portal and have already setup Salesforce as an IdP.

Note: These steps reflect a third-party application and are subject to change without our knowledge. However, even if the steps described here do not fully match the screens you see in your IdP account, using these steps along with the IdP’s documentation should still enable you to configure the integration.

Step One: Begin Adding The Integration In The LMS

  1. While signed in to the LMS as an administrator, go to System > Integration > Single Sign-On (SSO) > SAML Sign-In
  2. Click the + Add An Integration button.
  3. Select Salesforce from the list of SAML Identity provider.
  4. Keep this screen/tab open for now as we will refer to it later.
Figure 1
Figure 1: Add A New Integration Screen in The LMS

Step Two: Adding The LMS To Your Salesforce Applications

  1. In a new tab/window, access Salesforce.
  2. Go to Setup > Apps > App Manager > New Connected App.
Figure 2
Figure 2: Salesforce > New Connected App
  1. Edit the Conncted App Name, entering My LMS.
  2. Edit the API Name, entering Axis_LMS.
  3. Enter your Contact Email.
  4. Keep this screen/tab open for now as we will refer to it later.

Step Three: Add Service Provider Details To Salesforce

In this step, we’ll define the service provider values that Salesforce will need to identify your app.

  1. On the Add A New Integration screen in the LMS, go to the Service Provider Details section.
  2. In Salesforce scroll down to the Web App Settings section a check the box for Enabled SAML.
  3. Copy values from the LMS into Salesforce fields as shown below.
Copy LMS Field Value to Salesforce Field
Entity ID > Entity Id
Assertion Consumer Service / SSO Service > ACS URL
  1. Set Subject Type to User ID.
  2. Set Name ID Format to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.
  3. Leave all other settings in the Web App Settings section as-is.
  4. Scroll to the bottom and click the Save button.

Step Four: Add Identity Provider Details To The LMS

In this step, you'll provide the LMS with the SAML Identity provider values it needs to communicate with Salesforce.

  1. In Salesforce, on the app info screen, click the Manage button.
  2. Scroll down to the SAML Login Information section.
  3. Copy values from the SAML Login Information section and paste them into the Identity Provider Details section of the LMS, as shown below.
Copy Salesforce Field Value to LMS Field Value
Issuer > Entity ID / Issuer URL
IdP-Initiated Login URL > SAML 2.0 Endpoint / SSO URL
Download Metadata > (Open in Text Editor > X.509 Certificate > X.509 Certificate

After copying values into the Identity Provider Details section of The LMS, it should look something like this:

Figure 3
Figure 3: LMS Identity Provider Details

Step Five: Defining User Attributes

In this step, we’ll define the information about the user (id, email address, first name, last name) that need to be passed to the LMS.

  1. In Salesforce, scroll down to the Custom Attributes section.
  2. Click the New button in the upper right corner of the attribute listing.
  3. Under Attribute Key enter "uuid" (without quotations).
  4. In the Attribute Value text input, enter "$User.Id" (without quotations), then click Save.
  5. Repeat this sequence three more times, using the fields/values below.
Field > Value
emailAddress > $User.Email
firstName > $User.FirstName
lastName > $User.LastName

Note: Even though Salesforce may provide additional user data that can be passed as parameters, only the paramters listed above are compatible with the LMS; all other values will be ignored.

Step Six: Finshing Up & Testing

At this point you've completed all the necessary steps to configure the LMS application in Salesforce.

In the LMS, on the Add A New Integration screen, finish configuring the User Login settings and then click Save to save the integration in the LMS.

To test your new integration, you'll need to give users access to your new application in Salesforce before using the newly generated LMS login link for this integration. For more information on granting users access to your application via Salesforce, please refer to the IdP's documentation.