THIS FEATURE REQUIRES A BUSINESS PLAN
Please note that single-sign-on (SSO) is only available on Business plans. This feature is not available on smaller plans (such as Lite). Please contact our team at [email protected] if you would like access to this feature but it is not activated in your portal.
We assume you have already set-up Salesforce as your Identity Provider, have created an Identify Provider Certificate and have a working knowledge of Salesforce.
1 – Login to your Salesforce administration website.
2 – Navigate to your App Manager (Platform Tools/Apps/App Manager) and create a ‘New Connected App’.
3 – Complete the ‘Connected App Name’ and ‘API Name’ fields (e.g. Tribal Habits) and the contact email field (your Tribal Habits administrator). Under Web App Settings, check the Enable SAML box.
4 – Log in to your Tribal Habits platform as a Super Admin and navigate to Admin → Account → Security, then click "Manage" next to "Enable SAML Single-Sign-On (SSO)". Copy your Single Sign On URL from the Identity Provider Config panel. It will look like https://myorg.tribalhabits.com/saml/auth or similar.
5 – Return to the Connect App set up in Salesforce and…
- Paste the Tribal Habits URL into the ‘Start URL’, ‘Identity ID’ and ‘ACS URL’ fields as below.
- For ‘Name ID Format’ select ‘SAML 2.0 format:persistent” or similar.
- For ‘IdP Certificate’ select the required certificate (created when you established Salesforce as an Identity Provider).
6 – Select Save to create the Connect App.Select the Manage Connect Apps option from the menu (Platform Tools/Apps/Connected Apps/Manage Connected Apps) and select this connected app. Scroll to the end of that page to Custom Attributes.
7 - Create three new custom attributes for first name, last name, username and email. Note that the correct case of each letter is important.
- Key: FirstName. Attribute: $User:FirstName
- Key: LastName. Attribute: $User:LastName
- Key: Email. Attribute: $User:Email
8 – Scroll back to the top of the Connect App page and selected Edit Policies. At the bottom of that page, check ‘Enable User Provisioning’ and save.
9 – Return to your SSO settings in Tribal Habits (Admin → Account → Security → Manage) and…
- Check the box to ‘Enable’ SAML.
- Paste your Salesforce URL into the ‘Identity Provider Entity ID’ field (e.g. https//myorg.my.salesforce.com).
- Paste the SP-Initiated Redirect Endpoint URL (from your Connect App) into the ‘Identity Provider SSO URL’ field (e.g. https://myorg.my.salesforce.com/idp/endpoint/HttpRedirect).
- Paste your IdP certificate, including the BEGIN and END certificate notes, into the ‘Identity Provider x.509 Certificate’ field (download your IdP certificate from Salesforce and open in Notepad or similar to obtain it).
7 – Select Update SAML Configuration.
At this point your SAML set-up is complete. Once you assign Profiles to your Tribal Habits connected app in Salesforce, your users can access the app from the App launch and will be logged directly into Tribal Habits.
Before you go live
Once SSO is working, review the Authentication settings in Admin → Account → Security, covered in our main SSO article. In particular, decide whether to prevent auto-provisioning of new users via SSO, since any HR sync or identity management integration should usually create and populate users before their first SSO login.
If you run into problems, see our troubleshooting article for common SSO errors and fixes.