Skip to contentSkip to navigationSkip to topbar
On this page

Configure Salesforce SSO with Flex


This document walks through the setup process for Salesforce SSO in Twilio Flex. You'll need access to your Salesforce instance and permissions to configure it, as well as access to the Twilio Console.

(information)

Info


Create a self-signed certificate in Salesforce

create-a-self-signed-certificate-in-salesforce page anchor

You'll start by creating a certificate. You'll need to share this with Twilio later.

  1. Navigate to Settings > Security > Certificate and Key Management
  2. Press Create Self-Signed Certificate button
  3. Give the certificate a label and Unique Name, e.g., SalesforceSSO
  4. Key Size default of 2048
  5. Exportable Private Key should be ticked
  6. Press Save.
  7. Press Download Certificate (you'll need the certificate later)
Certificate and Key Edit Salesforce.

Enable Salesforce Identity Provider in Salesforce

enable-salesforce-identity-provider-in-salesforce page anchor

Make sure that the Identity Provider is enabled in Salesforce.

  1. On the Setup page, on the left sidebar, navigate to Settings > Identity > Identity Provider.
  2. Click Enable Identity Provider .
  3. Select the certificate you created in Create a self-signed certificate in Salesforce .
  4. Click Save .

Create a Twilio Flex Connected App in Salesforce

create-a-twilio-flex-connected-app-in-salesforce page anchor

Let's point Salesforce to the Flex side of the integration.

  1. On the Setup page, navigate to Platform Tools > Apps > App Manager .
  2. Click New Connected App .
  3. Set Connected App Name to "Twilio Flex".
  4. Set API Name to "Twilio_Flex".
  5. Enter a suitable email address for Contact Email .

Web App Settings

web-app-settings page anchor
  1. In the Web App Settings section, set the Start URL to https\://flex.twilio.com/agent-desktop(link takes you to an external page) .
  2. Confirm that the Enable SAML checkbox is selected.
  3. Set Entity Id to the appropriate value for your SSO configuration type:

    • Enhanced SSO configuration:
      Copy this value from the Set up your identity provider page, which provides the specific value for your account. urn:flex:JQxxxx
    • Legacy SSO configuration:
      Remember to replace ACxxx with your Twilio Account SID(link takes you to an external page) . https://iam.twilio.com/v1/Accounts/ACxxxx/saml2/metadata
  4. Set ACS URL to the appropriate value for your SSO configuration type:

    • Enhanced SSO configuration:
      Copy the ACS URL value from the Set up your identity provider page, which provides the specific value for your account. Your value will look similar to this: https://login.flex.us1.twilio.com/login/callback?connection=JQxxxx
    • Legacy SSO configuration:
      Remember to replace ACxxx with your Twilio Account SID(link takes you to an external page) . https://iam.twilio.com/v1/Accounts/ACxxxx/saml2
  5. Set Subject Type to Username.
  6. Set Name ID Format to urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified .
  7. Set Issuer to https\://yourdomain.my.salesforce.com/
  8. Set IdP Certificate to the certificate you created in Create a self-signed certificate in Salesforce .
  9. Check that the Verify Request Signatures option is unticked.
  10. Check that the Encrypt SAML Response option is unticked.
  11. Click Save .
  1. Navigate to App > App Manager .
  2. Search for the App you created in Create a Twilio Flex Connected App in Salesforce .
  3. Click on the caret symbol and select View .
  4. Click on New under the Custom Attributes section.
  5. Add the two custom attributes:

    KeyValue
    full_name$User.FirstName + " " + $User.LastName
    roles"agent" (must be in quotes)
(information)

Info

This will grant all users agent permissions in Flex. If you need to add supervisor or admin permissions, edit the "roles" custom attributes in the App Manager and include the roles in a comma separated value format. e.g: "agent, supervisor, admin" will grant the users the agent, supervisor, and admin role in Flex.

Create a Salesforce User

create-a-salesforce-user page anchor

You can create a Salesforce user that will then be able to be used to login to Twilio Flex using SSO.

  1. On the Setup page, navigate to Administration > Users > Users.
  2. Click New User .
  3. Fill in the required values:

    • First Name
    • Last Name
    • Alias
    • Email (You'll need this to receive a verification email)
    • Username (You'll use this to login later)
    • Nickname
  4. Select Salesforce for User License .
  5. For Profile , select Standard User . This is to ensure that user can access Twilio Flex.
  6. Scroll down and check Generate new password and notify user immediately .
  7. Click Save .
  8. Check your email for instructions on how to verify your account.

Assign Profile Access to the Connected App

assign-profile-access-to-the-connected-app page anchor
  1. On the Setup page, navigate to Administration > Users > Profiles .
  2. Edit the Standard User profile.
  3. Under Connected App Access , check the box for Twilio Flex app.
  4. Click Save .
(warning)

Warning

Salesforce users that are assigned to specific Profiles must have profile access to your Twilio Flex app. In Create a Salesforce User, we created a user and assigned the Standard User profile. Profiles that do not have access will not be able to complete SSO with Flex.


Set up SSO in Twilio Flex

set-up-sso-in-twilio-flex page anchor

Almost done! Now, you need to configure the Twilio side of the integration.

  1. Open the Twilio Flex Single Sign-On admin page(link takes you to an external page) .
  2. Set Friendly Name to something related, e.g: SalesforceSSO .
  3. Copy the contents of the certificate you downloaded earlier in Step 8 from Create a self-signed certificate in Salesforce .
  4. Paste the certificate contents for the X.509 Certificate field.
  5. Set Identity Provider Issuer to https://<your-salesforce-subdomain>.salesforce.com/ .
  6. Set SSO URL to https://<your-salesforce-subdomain>.salesforce.com/idp/endpoint/HttpRedirect .
  7. Set Default Redirect URL to https://<your-salesforce-subdomain>.salesforce.com/idp/endpoint/HttpRedirect .
  8. Click Save .

Testing SSO in Twilio Flex

testing-sso-in-twilio-flex page anchor

To test your Salesforce integration with Twilio Flex, enter the auto-generated login link in your address bar. You can find it in the Flex Single Sign-On settings.

You will be redirected to Salesforce and will be required to login with your Salesforce credentials. Once you successfully authenticate using your Salesforce user, you should be redirected to Twilio Flex and have completed Single Sign-On with Salesforce!

Need some help?

Terms of service

Copyright © 2024 Twilio Inc.