THIS FEATURE REQUIRES AN ACTIVE 50 PLAN OR LARGER
Please note that single-sign-on (SSO) is only available on Active 50 or larger plans. This feature is not available on smaller plans (such as Starter) or legacy plans (older monthly plans). Please contact our team at [email protected] if you would like access to this feature but it is not activated in your portal.
We assume you have already set-up Salesforce as your Identity Provider, have created an Identify Provider Certificate and have a working knowledge of Salesforce.
1 – Login to your Salesforce administration website.
2 – Navigate to your App Manager (Platform Tools/Apps/App Manager) and create a ‘New Connected App’.
3 – Complete the ‘Connected App Name’ and ‘API Name’ fields (e.g. Tribal Habits) and the contact email field (your Tribal Habits administrator). Under Web App Settings, check the Enable SAML box.
4 – Login to your Tribal Habits platform, switch to Admin view. Go to the Account area and select Configure SAML. Copy your Single Sign On URL from the panel on the right. It will look like https://myorg.tribalhabits.com/saml/auth or similar.
5 – Return to the Connect App set up in Salesforce and…
- Paste the Tribal Habits URL into the ‘Start URL’, ‘Identity ID’ and ‘ACS URL’ fields as below.
- For ‘Name ID Format’ select ‘SAML 2.0 format:persistent” or similar.
- For ‘IdP Certificate’ select the required certificate (created when you established Salesforce as an Identity Provider).
6 – Select Save to create the Connect App.Select the Manage Connect Apps option from the menu (Platform Tools/Apps/Connected Apps/Manage Connected Apps) and select this connected app. Scroll to the end of that page to Custom Attributes.
7 - Create three new custom attributes for first name, last name, username and email. Note that the correct case of each letter is important.
- Key: FirstName. Attribute: $User:FirstName
- Key: LastName. Attribute: $User:LastName
- Key: Email. Attribute: $User:Email
8 – Scroll back to the top of the Connect App page and selected Edit Policies. At the bottom of that page, check ‘Enable User Provisioning’ and save.
9 – Return to the Configure SAML page in Tribal Habits and…
- Check the box to ‘Enable’ SAML.
- Paste your Salesforce URL into the ‘Identity Provider Entity ID’ field (e.g. https//myorg.my.salesforce.com).
- Paste the SP-Initiated Redirect Endpoint URL (from your Connect App) into the ‘Identity Provider SSO URL’ field (e.g. https://myorg.my.salesforce.com/idp/endpoint/HttpRedirect).
- Paste your IdP certificate, including the BEGIN and END certificate notes, into the ‘Identity Provider x.509 Certificate’ field (download your IdP certificate from Salesforce and open in Notepad or similar to obtain it).
7 – Select Update SAML Configuration.
At this point your SAML set-up is complete. Once you assign Profiles to your Tribal Habits connected app in Salesforce, your users can access the app from the App launch and will be logged directly into Tribal Habits.
Troubleshooting
If you need to troubleshoot your SAML settings, but cannot access your portal any longer, you can login with your Tribal Habits user details at yourorganisation.tribalhabits.com/accounts/sign_in_without_sso