Configure Salesforce SSO with Flex

1. Follow Salesforce's documentation to generate a self-signed certificate.
2. When creating your certificate, leave the Key Size field set to 2048 and the Exportable Private Key option selected. These are the defaults.
3. Once you've downloaded your certificate, keep it available for later. You'll enter the contents of this file when you set up SSO in Flex.

Follow Salesforce's documentation to enable Salesforce as an IdP using the self-signed certificate you created in the previous section.

Follow Salesforce's documentation to create a connected app for Twilio Flex, and then use the steps in the following sections to configure the app.

Under Basic Information, enter the following information:

1. Set Connected App Name to Twilio Flex.
2. Set API Name to Twilio_Flex.
3. In Contact Email, enter an email address.

Under Web App Settings, enter the following information:

1. Set the Start URL to https\://flex.twilio.com/agent-desktop.
2. Click Enable SAML. Additional fields appear.
3. Set Entity Id to the appropriate value for your SSO configuration type:

• Enhanced SSO configuration:
  Copy this value from the Set up your identity provider page, which provides the specific value for your account. For example, urn:flex:JQxxxx
• Legacy SSO configuration:
  Remember to replace ACxxx with your Twilio Account SID. Your value will look similar to this: https://iam.twilio.com/v1/Accounts/ACxxxx/saml2/metadata

4. Set ACS URL to the appropriate value for your SSO configuration type:
   • Enhanced SSO configuration:
     Copy the ACS URL value from the Set up your identity provider page, which provides the specific value for your account. Your value will look similar to this: https://login.flex.us1.twilio.com/login/callback?connection=JQxxxx
   • Legacy SSO configuration:
     Remember to replace ACxxx with your Twilio Account SID. Your value will look similar to this: https://iam.twilio.com/v1/Accounts/ACxxxx/saml2
5. Leave Subject Type as Username. This is the default.
6. Leave Name ID Format as urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified. This is the default.
7. Make sure Issuer is set to https\://YOUR_DOMAIN.my.salesforce.com/, where YOUR_DOMAIN is your Salesforce domain. This is the default.
8. Set IdP Certificate to the certificate you created in Create a self-signed certificate in Salesforce.
9. Make sure Verify request signatures isn't selected.
10. Make sure Encrypt SAML Response isn't selected.
11. Click Save. The Manage Custom Apps page opens.

1. In the Custom Attributes section, click New to create each of the following attributes:

   Key	Value
   full_name	$User.FirstName + " " + $User.LastName
   roles	"agent" (must be in quotes)

Follow Salesforce's documentation to add a Salesforce user you can use to log in to Flex using SSO.

Make sure to specify the following setting values:

1. In User License, select Salesforce.
2. In Profile, select Standard User. This ensures the user can access Flex.
3. Under Approver Settings, make sure Generate new password and notify user immediately is selected.

To log in to Flex, Salesforce users must be assigned a profile that has access to the Twilio Flex app. In the previous section, you assigned the user the Standard User profile. Follow these steps to give the Standard User profile access to the Twilio Flex app.

1. In Salesforce, from Setup, in the Quick Find box, enter Profiles, and then select Profiles.
2. Edit the Standard User profile.
3. Under Connected App Access, select the Twilio Flex app.

After completing Salesforce setup, configure your Flex SSO connection to use Salesforce as the IdP.

1. In Twilio Console, navigate to Flex > Users and access > Single sign-on (SSO).
2. Set the Friendly Name to a recognizable name, like SalesforceSSO.
3. Copy the contents of the certificate you downloaded in Create a self-signed certificate in Salesforce.
4. In X.509 Certificate field, paste the certificate contents.
5. Set Identity Provider Issuer to https://<your-salesforce-subdomain>.salesforce.com/.
6. Set SSO URL to https://<your-salesforce-subdomain>.salesforce.com/idp/endpoint/HttpRedirect.
7. Set Default Redirect URL to https://<your-salesforce-subdomain>.salesforce.com/idp/endpoint/HttpRedirect.
8. Click Save.

To test your Salesforce integration with Flex:

1. On the Single Sign-On (SSO) page, find the auto-generated login link.
2. Copy the link and paste it in your address bar.
   The browser redirects you to Salesforce.
3. Log in using your Salesforce credentials.
   After your credentials are authenticated, the browser redirects you back to Flex. This redirect indicates your SSO configuration is working.