Welcome to Integrating Active Directory with Salesforce
using Identity Connect.
Identity Connect is an on-premise software
that integrates Active Directory with Salesforce
for both user authentication and synchronization.
It can run on either Linux or Windows servers.
Let's set up Identity Connect.
First, we need to download the software.
The download link is available from the Identity Connect page
under Salesforce Setup.
Let me start the download.
This page is visible only if Identity Connect licenses
are available in your Salesforce org.
As you can see, this org has 100 Identity Connect licenses.
The download is now complete.
Next step is to install it.
You can simply unzip it on the machine
where you would like to run it.
Identity Connect requires Java to be present.
As you can see, I have Java installed on my machine.
Now start Identity Connect by running setup.sh command,
accepting the defaults.
If you're installing it on a Windows machine,
the process is slightly different.
First, set JAVA_HOME environment variable, if not already set.
Then from the bin directory, turn
installservice.vat to install Identity Connect as a service.
Next step is to configure Identity Connect.
Open up a browser and navigate to localhostport8443-admin.
Enter Active Directory connection information
such as host, quote, administrator DN and password.
Then enter the base context DN.
All users under this business context
will be used by Identity Connect to authenticate and synchronize
users.
Ensure that you also in a base context
containing AD group, whose members are authorized
to administer this console.
Click Validate Settings.
You will now be prompted to select
AD group, whose members are authorized
to access this console.
I'm selecting the IC admins group.
Click Save.
You will be prompted to log in back into the admin console
with the user that belongs to the IC admins group you chose.
Now we need to establish connection with Salesforce.
OAuth is used for this connection.
Go to Salesforce Setup and create OAuth-connected app.
We will name this as Identity Connect.
Copy the OAuth callback URL from the Identity Connect Setup
page.
Select ID, API, and Refresh Token Scopes, and hit Save.
In general, it takes a few minutes
before the newly created OAuth-connected app
becomes available.
Copy the consumer key and paste it in the Identity Connect
console.
Then copy the secret and paste it.
Click Update.
The OAuth flow has kicked in.
After logging in as Salesforce Administrator,
accept the consent page allowing Identity Connect
to make API calls.
Next, we need to map the user attributes between Active
Directory and Salesforce.
We will use the default configuration for now,
but you can modify it to suit your needs, such as changing
the user name mapping or Federation ID mapping.
You can use JavaScript to transform the values
or set default values.
Identity Connect automates profile information
set assignment for the users based on the AD group
membership.
I'm going to map connect Admin group to System Administrator
profile, CRM80 group to Standard User Profile,
and Default to Identity Profile.
Click on the Sync tab.
Let's examine the association root
for linking existing users in Salesforce.
Let's go with the default. Before we run the first sync,
the table lets us analyze what Identity Connect is
going to sync.
It's telling me that there are two users in AD
and no match found in Salesforce.
If I click on the Others tab, it tells me
which users are in Salesforce that aren't mapped yet into AD.
Next, we need to set up when to synchronize the users.
We want updates in AD to be available immediately
in Salesforce.
So we will select Live Updates Policy.
Since we are happy with the associations, let's
run the first sync by clicking on the Sync Now button.
Identity Connect authenticates users against Active Directory
and uses SAML to single sign-on into Salesforce.
The setup for this is performed automatically
if multiple SAML configs is enabled in your Salesforce org.
Otherwise, you can enter SAML configuration manually too.
Notice that in my Salesforce org,
Identity Connect SAML configuration
was automatically created.
Click the Reports tab.
Here we can look into the report for the sync
job that was just executed.
If there are errors encountered, you
will see it in the Edit Report section.
Next we need to enable Identity Connect as the authentication
option in my domain settings.
We will deslect Login Page and select
Identity Connect as the only option
to authenticate the users.
The setup is now complete.
Now, let's create a user in AD and login as that user.
I'm using AD on Windows 2012 server,
but you can use AD on Windows 2008 or 2000.
I'm using the AD console to create
the user named Vikas Jain.
Enter the password, deslect Change password at first logon
and hit OK.
We need to now set the email address for this user.
For this demo, I'm going to use a fake email address
of vikasjain@demousers.com.
Now let's log in as this newly created user.
Navigate to My Domain URL for your Salesforce org.
Notice that it automatically redirected me to the login
page of Identity Connect.
I will now enter the AD username and password for Vikas Jain,
and I'm logged in.
Let's now update some information in Active Directory
and see the change getting propagated into Salesforce.
You will add a phone number for Vikas Jain.
As you can see, it's immediately available in Salesforce.
Let's see what happens when this user leaves the company.
We will disable the user in AD and the user
is immediately logged out of his active session.
There are many more features, such as, you can set up
Identity Connect to perform desktop single sign-on using
Integrated Windows Authentication and Kerberos.
In this example, I'm opening up my browser
where my homepage is set to Salesforce.
I'm automatically logged into Salesforce
without requiring to even enter Active Directory credentials.
Identity Connect supports highly available architecture.
You can use Identity Connect with not only Salesforce,
but also other applications using
Salesforce as a pass-through.
And that's how simple it is to integrate
Active Directory with Salesforce using Identity Connect.