Salesforce

1. What you'll set up

Salesforce as the service provider, IdP Simulator as the identity provider. When a user clicks "Log in with SSO" in Salesforce, they'll be redirected to your IdP Simulator realm, pick a persona, and land back in Salesforce signed in.

2. Configure IdP Simulator

1. Create a realm (or use an existing one) and go to the SAML tab.
2. Download your realm's metadata XML and certificate — you'll upload these into Salesforce next.
3. Under Service Provider, set:
   • Entity ID: https://<your-domain>.my.salesforce.com
   • ACS URL: https://<your-domain>.my.salesforce.com?so=<org-id>
   • NameID format: unspecified
   • Identity type: federation_id
4. Make sure at least one persona has a Federation ID that matches a Salesforce user's Federation ID.

3. Configure Salesforce

1. In Salesforce, go to Setup → search "Single Sign-On Settings".
2. Enable SAML if not already enabled.
3. Click New under SAML Single Sign-On Settings and fill in:
   • Name: IdP Simulator (or anything you like)
   • Issuer: paste your realm's Entity ID
   • Identity Provider Login URL: paste your realm's SSO URL
   • Identity Provider Certificate: upload or paste your realm's certificate
   • SAML Identity Type: "Assertion contains the Federation ID from the User object"
   • Service Provider Entity ID: https://<your-domain>.my.salesforce.com
4. Save.

4. Test the login

1. In Salesforce's SSO settings, click "Test" next to your new configuration — or visit your Salesforce login page and choose the SSO option.
2. You'll be redirected to IdP Simulator. Pick a persona whose email matches a Salesforce user.
3. You should land back in Salesforce, signed in as that user.

If it fails, check the error shown on the IdP Simulator side — it will tell you exactly what went wrong (wrong audience, bad NameID, signature mismatch).