Integrate a SAML SSO Service Provider as an External Client App

Create the Parent External Client App

<?xml version="1.0" encoding="UTF-8"?>
<ExternalClientApplication xmlns="http://soap.sforce.com/2006/04/metadata">
    <contactEmail>johndoe@example.com</contactEmail>
    <description>SAML external client app to integrate third-party service provider</description>
    <distributionState>Local</distributionState>
    <isProtected>false</isProtected>
    <label>mysamleca</label>
</ExternalClientApplication>

Create the External Client App Policies Configuration

1. In your <project directory>/force-app/main/default/ directory, create a directory called extlClntAppPolicies.
2. In the extlClntAppPolicies, create a file called <ECA policy name>.ecaPlcy-meta.xml.
3. Configure the <ECA policy name>.ecaPlcy-meta.xml file with these fields.

   Field	Description
   externalClientApplication	The name of the parent external client app as specified in its label field.
   isEnabled	Defines whether the external client app can use plugins. Set this field to true.
   isOauthPluginEnabled	Defines whether the external client app can use the OAuth plugin. Because the isEnabled plugin automatically turns on all plugins and this app is only for SAML, set this field to false.
   isSamlPluginEnabled	Determines whether the external client app can use the SAML plugin. Set this field to true.
   label	The name for the configurable policies.

   Here’s an example <ECA policy name>.ecaPlcy-meta.xml file.

   <?xml version="1.0" encoding="UTF-8"?>
          <ExtlClntAppConfigurablePolicies xmlns="http://soap.sforce.com/2006/04/metadata">
           <externalClientApplication>mysamleca</externalClientApplication>
           <isEnabled>true</isEnabled>
           <isSamlPluginEnabled>true</isSamlPluginEnabled>
           <isOauthPluginEnabled>false</isOauthPluginEnabled>
           <label>myecapolicy</label>
          </ExtlClntAppConfigurablePolicies>

Create the External Client App SAML Policies Configuration

1. In your <project directory>/force-app/main/default/ directory, create a directory called extlClntAppSamlConfigurablePolicies.
2. In the extlClntAppSamlConfigurablePolicies, create a file called <ECA SAML policy name>.ecaSamlPlcy-meta.xml.
3. Configure the fields for the <ECA SAML policy name>.ecaSamlPlcy-meta.xml file.
   For detailed information about what fields to include, see the ExtlClntAppSamlConfigurablePolicies metadata type in the Metadata API Reference Guide.
   Here’s an example <ECA SAML policy name>.ecaSamlPlcy-meta.xml file. This definition includes custom attributes, which are specified in the ExtlClntAppSamlConfigurablePoliciesAttribute subtypes.

   <?xml version="1.0" encoding="UTF-8"?>
   <ExtlClntAppSamlConfigurablePolicies xmlns="http://soap.sforce.com/2006/04/metadata">
       <acsUrl>https://www.<serviceprovideracsurl>.com</acsUrl>
       <entityUrl>https://www.<serviceproviderentityid>.com</entityUrl>
       <externalClientApplication>mysamleca</externalClientApplication>
       <issuer>https://mydomainname.my.salesforce.com</issuer>
       <label>myeca_samlpolicies</label>
       <nameIdFormat>Unspecified</nameIdFormat>
       <singleLogoutUrl>https://www.<serviceprovidersinglelogouturl>.com</singleLogoutUrl>
       <singleLogoutBindingType>RedirectBinding</singleLogoutBindingType>
       <subjectType>CustomAttribute</subjectType>
       <subjectCustomAttribute>MyCustomField</subjectCustomAttribute>
       <certificate>MIIDzDCCArQCCQCFaZKGsGqZ...</certificate>
       <encryptionCertificate>MIIDzDCCArQCCQCFaZKGsGqZ...</encryptionCertificate>
       <encryptionType>AES_128</encryptionType>
       <signingAlgorithmType>SHA1</signingAlgorithmType>
       <customAttributes>
           <key>User Firstname</key>
           <formula>$User.FirstName</formula>
       </customAttributes>
       <customAttributes>
           <key>User Country</key>
           <formula>$User.Country</formula>
       </customAttributes>
   </ExtlClntAppSamlConfigurablePolicies>

Create the Package.xml File

1. In your <project directory>, create a file called package.xml. Don’t create a subfolder for this file. Here’s how the file structure looks.
   
2. Add references to the ExternalClientApplication, ExtlClntAppConfigurablePolicies, and ExtlClntAppSamlConfigurablePolicies metadata types to the package.xml file.
   Here’s an example package.xml file.

   <?xml version="1.0" encoding="UTF-8"?>
   <Package xmlns="http://soap.sforce.com/2006/04/metadata">
       <types>
           <members>*</members>
           <name>ExternalClientApplication</name>
       </types>
       <types>
           <members>*</members>
           <name>ExtlClntAppConfigurablePolicies</name>
       </types>
       <types>
           <members>*</members>
           <name>ExtlClntAppSamlConfigurablePolicies</name>
       </types>
       <version>63.0</version>
   </Package>

Deploy the SAML-Enabled External Client App

Push the changes from your local project directory to Salesforce.

1. Open a new Terminal window.
2. Go to the <project directory>.
3. To deploy the package.xml file, run this command.

   sf project deploy start --manifest package.xml -o <username@targetorg.com>

4. To verify that the metadata was deployed correctly, run this command.

   sf project retrieve start --source-dir force-app -o <username@targetorg.com>

   After the external client app is deployed, you can see it in the External Client App Manager in Setup. But you can’t view or edit its SAML configuration information from Setup.

Edit the SAML-Enabled External Client App

If necessary, make edits to your external client app SAML configuration.

1. Update the corresponding metadata component files in your <project directory>/force-app/main/default/ directory.
   • To update general information about the external client app, such as its description or contact email, edit the <external client app name>.eca-meta.xml file.
   • To update the external client app policies, such as the label for the policies component, edit the <ECA policy name>.ecaPlcy-meta.xml file.
   • To update the SAML configuration information, edit the <ECA SAML policy name>.ecaSamlPlcy-meta.xml file.
2. To push the changes to Salesforce, deploy the package.xml file again by running this command.

   sf project deploy start --manifest package.xml -o <username@targetorg.com>

   Complete this step even if you edit only one of the components. You can't deploy a single component.
3. To verify that the metadata was deployed correctly, run this command.

   sf project retrieve start --source-dir force-app -o <username@targetorg.com>