Salesforce with Access for SaaS configuration

This tutorial covers how to:

• Configure Salesforce as a SaaS application in Cloudflare Zero Trust
• Force logins to Salesforce through Cloudflare’s Zero Trust rules

Time to complete:

15 minutes

​​ Prerequisites

Admin access to a Salesforce account

​​ Set up Salesforce as a SaaS application in Cloudflare Zero Trust

1. In Zero Trust Open external link , navigate to Access > Applications.
2. Select the SaaS application type.
3. Next, select Salesforce from the Application drop-down menu.
4. Fill the remaining fields as follows:
   • Entity ID: https://[YOUR_SFDC_DOMAIN].my.salesforce.com
   • Assertion consumer service URL: https://[YOUR_SFDC_DOMAIN].my.salesforce.com
   • Name ID format: Email
5. Click Next.
6. Set the desired policy configuration for user access.
7. Click Add application.
8. Next, take note of the SSO endpoint, the Access Entity ID or Issuer, and the Public Key.

​​ Create a certificate file

1. Paste the Public key in VIM or another code editor.
2. Wrap the certificate in -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.
3. Set the file extension as .crt and save.

​​ Enable Single Sign-On in Salesforce

1. In Salesforce, ensure your users have Federation IDs.
2. Navigate to Security Controls > Single Sign-On Settings.
3. Set the following global settings:
   • SAML Enabled: true
   • Make federation ID case-insensitive: true

​​ Create a new SAML Single-Sign On configuration

1. Create a new SAML Single-Sign On configuration:
   • Name: (this is what you want your users to see on sign in)
   • API name: (this will pre-populate)
   • Issuer: https://<your-team-name>.cloudflareaccess.com, where your-team-name is your team name.
   • Identity Provider Certificate: upload the .crt certificate file you’ve created in the previous step.
   • EntityID: https://[YOUR_SFDC_DOMAIN].my.salesforce.com
   • SAML Identity type: If the user’s Salesforce username is their email address, select Assertion contains the User’s Salesforce username. Otherwise, select Assertion contains the Federation ID from the User object and make sure the user’s Federation ID matches their email address.
   • Identity Provider Login URL: This is the SSO endpoint provided in Zero Trust for that application.
2. Click Save.
3. From the navigation panel on the left, click Domain Management > My Domain and select your domain.
4. At the bottom, find Authentication Configuration. Click Edit and select your Authentication Service you created.
5. (Optional) To force all users to sign in through Cloudflare Access:
   1. Click Security Controls > Single Sign-On Settings > Edit.
   2. Click Disable login with Salesforce credentials.