In this tutorial, we’ll use Workspace ONE Access to add Salesforce as a web app to the
unified app catalog.
This is actually the second part of the two-part process for providing users with single sign-on
access from the Intelligent Hub app or web portal.
In the preceding video, we did the first part, which is creating a Salesforce test environment
and configuring Workspace ONE Access as a third-party identity provider in Salesforce.
Okay, so, you already have a Salesforce test environment and have downloaded the Salesforce
metadata XML file.
We’re also going to assume that you already have a Workspace ONE Access tenant with Administrator
access, and that you have the Workspace ONE Access connector installed and synced with
your directory service.
If not, you can follow the two videos about this in the Evaluation Guide for Workspace
ONE Setup.
Begin by logging in to Workspace ONE Access.
Click the user icon to navigate to the Workspace ONE Access console.
Using the new navigation, click Resources > Web Apps > New.
Because the cloud application catalog contains commonly used enterprise Web applications,
we can search for Salesforce and select it.
Lots of fields are then automatically populated.
We’re not going to select a category for the app right now, but if you want, you can
click the drop-down list and select the Recommended category, or you could go create new categories
on the main Resources > Web Apps page.
Scroll down and click NEXT.
On the Single Sign-On Configuration page, click URL/XML.
To have something to paste into that box, go into your file system and find and open
that metadata XML file that you downloaded from Salesforce, as described in the aforementioned
first video in this series.
Open that XML file with a text editor and then select all and copy all the text in the
file.
Then you can go back to the Workspace ONE Access wizard and paste the text into the
text box.
Scroll down and click NEXT.
For this exercise, we’ll use the default access policy—more on that later.
Click NEXT.
And then click SAVE & ASSIGN.
On the Assign page, type in “all users.”
For the deployment type, select Automatic.
If you leave it set to User-Activated, then users have to go through an approval process
before they can use the application.
Click SAVE.
That was successful.
Now, there’s one more thing we need to tweak, so we’ll select the application and click
Edit.
Click NEXT to go to the Configuration page.
Scroll down.
For the Username Format, the help text says to leave the field unspecified unless the
service provider, Salesforce, requires particular subject format, and Salesforce does not for
this field, so we’ll leave this.
But the Username Value field is very important, and it does require a different value than
the default.
Salesforce is going to be looking for an email address, so change this setting to ${user.email}.
Click NEXT.
And click NEXT again.
Looks good, and click SAVE.
Now we’ll test it out.
Open a new incognito window and log in to Workspace ONE Access as the test user that
you configured in Salesforce, as described in that preceding video.
Select the test user’s domain, click NEXT, and enter the test user’s user name—just
the user name because the domain is already selected, and the password, and click Sign-in.
Salesforce appears in the app catalog.
Click the icon.
Fingers crossed.
And it worked!
Okay, since we have a little more time, I wanted to show you something about the access
policies you can create.
Go to Resources > Policies.
You can create your own policies, but for now we’ll just take a look inside the default
policy.
Select it and click EDIT.
The policy applies to one application right now, and that is Salesforce.
Click NEXT.
This table lists the rules that are currently defined.
It has one rule for the device type called Web Browser and another rule for the Workspace
ONE App or Hub App.
And all network ranges are allowed.
Now you could also click to add another rule for a specific device type.
There are many possible device types.
Then for the authentication method, we are using Password (cloud deployment).
You can also add a second method, for example, if you want to also have two-factor authentication.
We don’t see it in the drop-down list here, though, because I haven’t enabled it yet.
You can also add a fallback method.
Okay, we’re going to cancel out of this.
If you want to add to the list of possible authentication methods, go to Integrations
> Authentication Methods, and then select the radio button for the method and click
CONFIGURE.
The rules can be very granular and very powerful.
For more Workspace ONE technical resources, be sure to visit techzone.vmware.com.