1. Suchin Rengan Principal Technical Architect Salesforce.com
SSO Best Practices
Suchin Rengan
Principal Technical Architect
Salesforce.com

2. Best Practices (Delegated Authentication)
Implement DA mechanism only if SAML/OAuth is not deemed appropriate
Delegated Authentication needs custom development and thereby maintenance and support
Delegated Authentication is not an industry standard
Implementation considerations such as result must be returned within 10 seconds of request, else the request fails
Recommendation is not to enable this on System Administrator’s profile, since during an outage, there needs to be way for Sys Admins to log in

3. Best Practices (Delegated Authentication)
Implement using existing skill set within organization
Java/.NET skills
Make sure appropriate testing has been performed to handle large number of concurrent logins
Host the Delegated Authentication web service on a high available platform
Incorporate fault tolerance, load balancing and failover strategies
Reuse token/ credentials that adhere to corporate standards
Leverage existing credential store and services that can validate/ authenticate tokens

4. Make sure the IDP is on a high available environment
Best Practices (SAML)
Make sure the IDP is on a high available environment
Incorporate fault tolerance, load balancing and failover strategies
Use Federation Id instead of Salesforce username as subject Id for performance
Identity based on login and no mapping required to know Salesforce username
Login post is org specific and hence no time needed by Salesforce to resolve org instance
If using username then pass it in Attribute instead of Subject, this helps accomplish posting token to an instance URL

5. Best Practices (SAML)
Be proactive with regards to certificate (Salesforce and client) expirations
Schedule maintenance window prior to expiration to refresh certificates

6. Disabling users from directly logging into SF if SAML is enabled
Best Practices (SAML)
Disabling users from directly logging into SF if SAML is enabled
Implement Delegated Authentication service that will always return a ‘false’
Use MyDomains feature to restrict users from logging in directly
Implement custom logout, error pages to present custom messages instead of defaults
Leverage the corporate branded pages as appropriate with messages indicating whom to contact in case of errors

7. Best Practices (SAML)
Check for any time skews that may lead to inconsistent timeout/ session creation issues
Salesforce.com allows a maximum of three minutes for clock skew with your IDP server, make sure your server's clock is up-to-date
Perform periodic testing to make sure that the time skew is within couple of minutes
A quick process can be written to fetch times from the IdP and SF (getServerTimeStamp() ) and get the difference to make sure it is within limits