Social Single Sign-On with OpenID Connect
- 1. Social Single Sign-On with OpenID Connect James Melville Technical Architect @jamesmelv
- 2. James Melville Technical Architect
- 3. What is Social Single Sign On? • Ability to authenticate using social profiles
- 4. What is OpenID Connect? • Identity Protocol built on OAuth 2.0 • Verify a user’s identity using authentication by another server • Standard for sharing profile information • Finalised February 2014 • Large backers:
- 5. What can I do with Salesforce & OpenID Connect? • Provide users with a form of Single Sign On • Allow users to login to Salesforce using other credentials – Internal Users – Community Users • Use a variety of providers to authenticate users: – Google – Microsoft – Paypal – Ping Identity
- 6. Why Use OpenID Connect? User Benefits Business Benefits Fewer usernames and passwords to remember Automate or Simplify User Creation Quicker Login Reliable Source of User Details Reduced registration effort Reduce helpdesk interactions
- 7. How do I set this up with Salesforce? Using Google as the Identity Provider • Register as an OAuth client with Google – https://code.google.com/apis/console • Configure “Auth. Provider” in Salesforce – Setup -> Security Controls -> Auth Provider • Define the logic for user management • Use Auth Provider in My Domain / Community
- 8. How do I manage identities between systems? Implement a Registration Handler • Define the logic to be executed when a user logs in – Create a registration hander in Apex – Use the profile information from the provider • Unrecognised OpenID Connect profile – Match to an existing Salesforce user – Create a new user • Previously logged in profile – Update profile information
- 9. Login Demo
- 10. What Else? • OpenID Connect is built on OAuth 2.0 • OpenID Connect Identity + OAuth 2.0 Authorisation = API Access • Now use the Authorisation to access Resources • Define access using Scope, as per OAuth 2.0 • Use APIs from the Identity Provider
- 12. Useful URLs • Google API Console: https://code.google.com/apis/console • Google API Documentation: https://developers.google.com/drive/ • Apex Auth Docs: http://www.salesforce.com/us/developer/docs/apexcode/Content/apex_namespace_ Auth.htm • Demo Repository: https://github.com/jamesmelville/OpenIdConnectDemo •
- 13. Features I’d like to see • Ability to dynamically extend Scopes • Inspect scopes already claimed • Ability to create / update user credentials store