SAML重定向到特定的IDP（Salesforce与Arcot + PING + Siteminder）

Question

We need to support the following Authentication flows

• User 1 logs into Salesforce using Salesforce Credentials

• User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials

• User 2 logs into Custom App using Arcot + Ping + Siteminder credentials

Since all the authentication methods above are SAML, I need to find a way to address home realm discovery that is a unusual "mesh" of authentication flows.

Question

How should I set up the IDP and RPs to handle this scenario?

How would home realm discovery work?

Answer 1

I'm going to assume that you have My Domains setup and SAML 2.0 setup in your org, and you're trying to route an unauthenticated page request to its appropriate authentication source.

Since you can't distinguish between users 1 and 2 in the original unauthenticated request, you'll need an interstitial page that asks for user input, ie "Let me login with username/password" or "I login with single sign on". Point to this page in the "Identity Provider Login URL" section of your SAML settings. If the user chooses username/password, redirect the user to the My Domains login page where they'll login with un/pw. If they choose SSO, then send them to your IDP and propagate the SAML Request & RelayState to initiate the SAML protocol.

Similarly, unauthenticated requests to the custom app need to redirect to the IDP, so that they will initiate SAML. Is the custom app inside of salesforce (as a different tabset), or hosted outside of salesforce? If the custom app is separate from salesforce, you'll need to setup the identity provider so that it has 2 RPs: one for salesforce and one for this custom app. If the custom app is in salesforce, how is the user going to express intent to access salesforce vs the custom app?