Adding Salesforce.com

1. Log into your Passly Tenant.
2. Select SSO Manager.
3. Select the small plus in the bottom right corner.
   
4. Select Salesforce from the vertical list selection.
   
   
5. Enable the Application
   Select the preferred Authentication Policy.
6. Select Protocol Setup.
7. Updated the Audience URI: https://saml.salesforce.com
   
8. Select Add Application.
   
   
9. From the SSO Manager select Salesforce.
10. Select Permissions.
    Note: Here is where you will define the User groups that will have access to the App. 
11. Select Signing and Encryption.
12. Select Download Certificate.
    Note: You will need this certificate in the SFDC configuration.

Enabling Salesforce.com for SAML support

Next log into Salesforce.com with an administrator account and navigate to the Single Sign On settings section.

1. Configure the Single Sign On Settings as follows:
   1. SAML Enabled: Checked
   2. SAML Version: 2.0
   3. Issuer: https://<Your Passly tenant.my.passly.com>/trust
   4. User Provisioning Enabled: <User Preference>
   5. Identity Provider Login URL: https://<Your Passly tenant.my.passly.com>/SSO/federation/passive/Saml2SpInit
   6. SAML User ID Type: Assertion contains User’s salesforce.com username
   7. SAML User ID Location: User ID is in the NameIdentifier element of the Subject statement
   8. Service Provider Initiated Request Binding: HTTP Redirect
2. Upload the Identity provider certificate from the Passly Single Sign On server.

Once Salesforce.com has been configured for Single Sign-On, try logging in via you’re my Domain, e.g. https://customer.my.salesforce.com.

This should redirect you to Passly Single sign On, prompt for your MFA credential, and redirect back into Salesforce.

For more information on how to use Rich Clients like Salesforce Chatter with Single Sign On take a look at the Developerforce article: Single Sign-On for Desktop and Mobile Applications using SAML and OAuth. You will find the pertinent configuration details under the "A Detailed Example section".