# Salesforce

> Set up Ironchip as the SAML identity provider for Salesforce: enable SSO, exchange metadata, and make Ironchip the only sign-in method.

URL: https://docs.ironchip.com/en/identidad/integraciones/saas/salesforce/

Ironchip acts as the identity provider (IdP) for Salesforce over SAML. This guide explains how to enable single sign-on and, optionally, how to require users or groups to sign in with Ironchip only.

## Requirements

- Access to the Ironchip admin console.
- A user with the permissions needed to configure Salesforce.

## Configure single sign-on

1. Sign in to Salesforce as an administrator and go to **Setup**.

   [Image: Salesforce setup menu]

2. Go to **Identity** and then **Single Sign-On Settings**.

   [Image: Single Sign-On Settings in Salesforce]

3. Click **Edit**, enable **SAML Enabled**, and click **New from Metadata File**.

   [Image: Steps to edit the settings, enable SAML, and create from a metadata file]

4. In the Ironchip admin console, go to **Applications** and click **New application**.

   [Image: New application button in the Ironchip admin console]

5. On the **Custom application** card, click **Create application**.

   [Image: Custom application card with the Create application link]

6. Select the **SAML** type and download the metadata file with **Download metadata file**.

   [Image: Selecting the SAML type and downloading the metadata file]

7. Upload the downloaded file to Salesforce and click **Create**.

   [Image: Uploading the Ironchip metadata file in Salesforce]

8. Save the changes (change the name if you want) and download the Salesforce metadata with **Download Metadata**.

   [Image: Saved Single Sign-On Settings with the Download Metadata button]

9. Upload that file to a public internet address and enter its URL, in raw format, in the **Metadata URL** field of the Ironchip form.

   [Image: Metadata URL field of the Ironchip Add a new application form]

10. Click **Add service** to add the application.
11. Create the users in Ironchip as shown in the video. The username must be the same as in Salesforce.

Video: [Creating Salesforce users in Ironchip](https://play.hubspotvideo.com/v/7745202/id/147410624908)

## Activate Ironchip as an authentication method

1. In Salesforce, search for **My Domain** with the search bar.

   [Image: Searching for My Domain in Salesforce]

2. In **Authentication Configuration**, click **Edit**.

   [Image: Edit button in Authentication Configuration]

3. Under **Authentication Service**, select the new authentication method and click **Save**.

   [Image: My Domain authentication configuration with the new method selected under Authentication Service]

The integration is now configured.

## Verify the integration

1. Go to the Salesforce sign-in page and select the Ironchip sign-in option shown below the form.

   [Image: Salesforce sign-in page with the Ironchip option]

2. Enter the username.

   [Image: Username field]

3. Authorize the connection from the Ironchip app.

   [Image: Authorization request in the Ironchip app]

## Salesforce with Ironchip only

This part explains how to configure Salesforce so the users or groups you choose can only authenticate with Ironchip.

### Requirements

- Salesforce protected by Ironchip.
- The users you are going to configure already added in Ironchip.

### Configuration

1. Go to **Single Sign-On Settings** and enable **Disable login with Salesforce credentials**.

   [Image: Option to disable login with Salesforce credentials]

2. Go to **Permission Sets** and click **New**.

   [Image: Permission Sets list with the New button]

3. After you create the set, enter **Single Sign-On** in the search bar and click the only option that appears.

   [Image: Searching for Single Sign-On in the permission set]

4. Click **Edit**, enable the marked option, and save the changes.

   [Image: Single sign-on option enabled in the permission set]

5. Go to the **Users** or **Groups** panel, depending on which one you want to modify, and click the name of the user or group.

   [Image: User list with the name of the user to modify]

6. Scroll down to **Permission Set Assignments** and click **Edit**.

   [Image: Permission Set Assignments section of the user]

7. Add the set you created at the beginning and save the changes.

   [Image: Permission set added to the user's assignments]

### Verify the restriction

Try to sign in with the credentials of a user configured with this rule. Entering a Salesforce username and password doesn't let you in. Using Ironchip does.