Single Sign-on with Salesforce via SAML 2.0

This article explains how to configure SAML 2.0 authentication integration between Salesforce and Questetra.

Salesforce is used as the SAML Identity Provider (IdP), and Questetra BPM Suite is configured as the Service Provider (SP).

For an overview of SAML SSO in Questetra BPM Suite, please refer to the following:

M310: Enabling Single Sign-On Using an External Authentication Service (SAML)

Only certain Salesforce Editions can be used as an IdP. Please check in advance whether your Salesforce Edition supports this. Enabling an Identity Provider (Salesforce Help)

1. [Questetra BPM Suite] Check the SP Information

First, check the SP information on the Questetra side. You will use this when configuring Salesforce.

Go to “System Settings” → “SSO (SAML)”, and on the “Single Sign-On (SAML)” settings screen, select “Enable Single Sign-On”. You are only checking the values here, so there is no need to save at this point.

Check the following two values:

Entity ID
ACS URL

Note these values down, then move on to the Salesforce configuration.

2. [Salesforce] Check “My Domain”

To use Salesforce as a SAML IdP, “My Domain” must be enabled. In current versions of Salesforce this is generally enabled automatically, but please confirm it just in case.

Setup → Company Settings → My Domain

As long as a domain has been registered and its status is “Deployed”, there is no problem.

3. [Salesforce] Enable the Identity Provider

Setup → Identity → Identity Provider

Click “Enable Identity Provider”, select the certificate to use (or create a new one), and save.

4. [Salesforce] Add an External Client Application

Setup → Apps → External Client Apps → External Client App Manager

Click “New External Client App” and enter the following:

Basic Information

External Client App Name: any name (e.g., Questetra BPM Suite)
API Reference Name: any name (e.g., qbpms)
Contact Email: the responsible person’s email address
Distribution State: Local (leave as default)

Web App Settings

Check “Enable SAML”
Entity ID: copy the “Entity ID” from Questetra’s “SP Information”
ACS URL: copy the “ACS URL” from Questetra’s “SP Information”
Name ID Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Subject Type: select either “Username” or “Federation ID” (see below)

About Choosing the Subject Type

Questetra matches users by email address. Since you cannot specify an email address directly in “Subject Type”, use one of the following approaches instead.

If you choose “Username”: set each Salesforce user’s “Username” to the same value as the email address registered in Questetra
If you choose “Federation ID”: set each Salesforce user’s “Federation ID” to the same value as the email address registered in Questetra

Once configured, click “Create.”

5. [Salesforce] Assign Users

Configure which users are allowed to use the external client application. This is managed via permission sets.

Creating and assigning a permission set:

Go to “Setup” → “Users” → “Permission Sets” and create a new permission set
From the permission set’s “Manage Assignments”, add the target users

Adding the permission set to the external client application:

“Setup” → “Apps” → “External Client Apps” → “External Client App Manager” → target app → “Policies” tab → “Edit” → “Select Permission Sets”

Only assigned users will be able to log in to Questetra BPM Suite via single sign-on.

6. [Salesforce] Check the SSO Information

Obtain from Salesforce the information needed for the Questetra configuration.

Setup → Identity → Identity Provider

Click “Download Metadata” to obtain the XML file. Check the values from the following elements in the XML file.

Issuer: the value of the entityID attribute in <EntityDescriptor entityID=”…”> → enter this in Questetra’s “Entity ID” field
Login URL: the value of the Location attribute in <SingleSignOnService Binding=”urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST” Location=”…”/> → enter this in Questetra’s “Login Page URL” field

Obtain the certificate from “Download Certificate” on the “Identity Provider” page.

7. [Questetra BPM Suite] Configure the Identity Provider Settings

Finally, configure the settings on the Questetra side.

Go to “System Settings” → “SSO (SAML)” and select “Enable Single Sign-On”. Enter the Salesforce information confirmed in Step 6 as follows.

Entity ID — the Issuer (entityID) confirmed in Step 6
Login Page URL — the Login URL confirmed in Step 6
Certificate — open the certificate file downloaded in Step 6 in a text editor, and copy and paste everything from —–BEGIN CERTIFICATE—– to —–END CERTIFICATE—– as-is

Once entered, click “Save”.

This completes the single sign-on setup. You can now log in to Questetra BPM Suite via single sign-on from its login page. If you are already logged in to Salesforce, you will be taken directly to a page within Questetra BPM Suite. If you are not yet logged in to Salesforce, you will first go through the Salesforce login screen before being taken to a page within Questetra BPM Suite.

If It Doesn’t Work

Please double-check your configuration. The following points are especially prone to mistakes.

Whether the “Entity ID” in Salesforce matches the “Entity ID” in Questetra
Whether the “ACS URL” in Salesforce matches the “ACS URL” in Questetra
Whether the Username or Federation ID (the field set in “Subject Type”) on Salesforce matches the corresponding Questetra user’s email address
Whether the target user has been granted access to the external client application

If everything appears to be configured correctly but it still doesn’t work, check “Administration” → “System Log” for a record of the login failure. The log will contain details of the error.

SAML Error: Invalidated Session — This is a temporary session issue. Reopen your browser and try again.
SAML Error: AuthnStatement/@AuthnInstant is invalid — Too much time has passed since authenticating at the IdP. Try logging in to the IdP again, or extend the “Authentication Validity Period” setting on the Questetra side.
No SAML Error listed — No user in Questetra matches the value sent by the IdP. Re-check the “Subject Type” configuration from Step 4.

If a different error message is recorded, please review the configuration checklist above again. If the issue still isn’t resolved, please contact Questetra support (and be sure to include the error details from the system log when you do).