SP initiated SSO from OpenAM & SalesForce using Custom Authentication

Question

I did SP initiated SSO for SalesForce and OpenAM successfully. In SalesForce SSO setting I used Identity Provider Login URL : http://localhost:8080/opensso/SSOPOST/metaAlias/idp

This URL accept SAML request and created SAML Assertion for SalesForce with IDP default login authentication.

Instead of above URL I when I use my Custom Authentication Module URL. It does:

1. It redirect to IDP with custom authentication

2. Does the authentication and display IDP home page.

It won’t show SalesForce home page. I checked debug log it is not creating SAML assertion for SalesForce.

Is it possible to create SAML assertion from IDP? Or should custom authentication module has to take care to create SAML assertion?

Answer 1

Don't change the URL in the Salesforce SSO settings - that needs to remain http://localhost:8080/opensso/SSOPOST/metaAlias/idp in order to do SAML. Instead, in the extended metadata for the identity provider, you should set AuthUrl to your custom auth module URL - e.g. http://localhost:8080/opensso/UI/Login?module=CustomAuth.

This document at Oracle describes a similar configuration http://docs.oracle.com/cd/E19575-01/820-4729/ggxft/index.html