<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
Kari,
<div><br>
</div>
<div>I've done a small bit of interoperability testing with the <a href="http://Salesforce.com">
Salesforce.com</a> IdP and the MITREid Connect Relying Party (client code). I have not done any testing in the other direction, with the MITREid Connect IdP and a Salesforce-driven client. Is this their own client library? Is there any indication what Salesforce
doesn't like about the response? Is it a problem with the SSL certificates on your test server, perhaps? I've seen that break things many times. It's also possible that Salesforce is looking for something special that we don't return in the same way that their
own IdP does. It seems like this would be a good issue to bring to the Salesforce help desk, if you haven't already. We'd be happy to work with their engineers to make this work if you can get us connected.</div>
<div><br>
</div>
<div> -- Justin</div>
<div><br>
<div>
<div>On Sep 4, 2014, at 6:31 AM, Kari Hiitola <<a href="mailto:kari.hiitola@vincit.fi">kari.hiitola@vincit.fi</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div dir="ltr">Hello,
<div><br>
</div>
<div>Has anyone successfully used MITREid Connect Identity Provider for authenticating
<a href="http://Salesforce.com">Salesforce.com</a> users?</div>
<div><br>
</div>
<div>I have created a simple webapp overlay (on top of MITREid Connect 1.1.9) that works perfectly with a test client
<a href="https://demo.c2id.com/oidc-client/">https://demo.c2id.com/oidc-client/</a> . I configured a Salesforce (developer account) custom domain to use OpenID Connect authentication and created a custom registration handler. With the same registration handler
and similar configuration I've been able to authenticate <a href="http://Salesforce.com">
Salesforce.com</a> against Google's Identity Provider. </div>
<div><br>
</div>
<div>Out maybe a couple of hundred times that I have tried, authentication has succeeded twice. And without changing anything, it then has started to fail again. Normally Salesforce gives error: "ErrorCode=Unknown_Flow, ErrorDescription=The flow type was not
recognized" which I couldn't find in <a href="http://Salesforce.com">Salesforce.com</a> documentation. The logs don't show the SF registration handler being run at all in these failed cases. Network traces show that
<a href="http://Salesforce.com">Salesforce.com</a> backend issues the POST to /token but apparently doesn't like the response somehow.</div>
<div><br>
</div>
<div>Any ideas? Am I alone with these problems, or even alone trying to get it to work?</div>
<div><br>
</div>
<div>Best regards,</div>
<div><br>
</div>
<div> - Kari Hiitola</div>
</div>
_______________________________________________<br>
mitreid-connect mailing list<br>
<a href="mailto:mitreid-connect@mit.edu">mitreid-connect@mit.edu</a><br>
http://mailman.mit.edu/mailman/listinfo/mitreid-connect<br>
</blockquote>
</div>
<br>
</div>
</body>
</html>