Configuring IdP and SSO Settings

Veeam Backup for Salesforce supports single sign-on (SSO) authentication using Azure Active Directory and Salesforce based on the OAuth 2.0 protocol. SSO authentication allows users to follow the corporate security policy and log in to Veeam Backup for Salesforce using the corporate identity provider (IdP).

Configuring IdP Settings Using Azure Active Directory

To configure IdP settings using Azure Active Directory, you must first create an Azure AD application for Veeam Backup for Salesforce in the Microsoft Azure portal. To learn how to register an application with the Microsoft identity platform, see Microsoft Docs.

When creating the application, consider the following:

• The following API permissions must be granted to the application:

• GroupMember.Read.All
• User.Read
• User.Read.All

• The redirect URI added to the application must match the management server FQDN that you use to access the Veeam Backup for Salesforce Web UI. To make sure that you are adding the correct URI, switch to the Configuration page and navigate to Security > Single Sign-On. The address will be displayed in the Callback URL field.

Configuring IdP Settings on Veeam Backup for Salesforce Side

To configure the IdP settings on the Veeam Backup for Salesforce side, do the following:

1. Switch to the Configuration page.
2. Navigate to Security > Single Sign-On.
3. Set the Enable single sign-on toggle to On.
4. From the Identity Provider drop-down list, select Azure Active Directory.
5. In the Application ID field, provide the Application (client) ID of the registered Azure AD application. You can find the ID on the app registration Overview pane in the Microsoft Azure portal.
6. In the Directory ID field, specify the Directory (tenant) ID of the registered Azure AD application. You can find the ID on the app registration Overview pane in the Microsoft Azure portal.
7. In the Client secret field, enter the value of a client secret created in the specified Azure AD application.

Keep in mind that you can see and copy a client secret value only when creating it. Otherwise, you will not be able to retrieve the value. To learn how to create client secrets, see Microsoft Docs.

8. Click Save. You will be redirected to the Microsoft authentication page. Enter the credentials of the Microsoft user and log in to the Azure AD application. Grant admin consent to the application if required. To learn how to do that, see Microsoft Docs.

As soon as the IdP settings are successfully configured, you can start adding users to Veeam Backup for Salesforce. Consider that the Veeam Backup for Salesforce session timeout is 60 minutes. If the session is expired, you must log in to Veeam Backup for Salesforce using the local administrator credentials once again, and continue adding users for the next 60 minutes.

Configuring IdP settings using Salesforce

You can configure Salesforce as an OpenID Connect identity provider that will allow users of your Salesforce organizations to log in to Veeam Backup for Salesforce. For more information, see Salesforce Documentation.

To be able to use Salesforce as an identity provider, you must grant the access unique user identifiers (openid) OAuth scope to the Connected App used to authorize access to all Salesforce organizations protected by this Veeam Backup for Salesforce installation. For more information on the Connected App, see Changing Connected App Tokens.

Configuring IdP Settings on Veeam Backup for Salesforce Side

To configure the IdP settings on the Veeam Backup for Salesforce side, do the following:

1. Switch to the Configuration page.
2. Navigate to Security > Single Sign-On.
3. Set the Enable single sign-on toggle to On.
4. From the Identity Provider drop-down list, select Salesforce.
5. From the Login domain field, choose one of the following:

• If you want to authorize users of Salesforce production organizations only, select Production.
• If you want to authorize users of Salesforce sandbox organizations only, select Sandbox.
• If you want to authorize users of a specific Salesforce organization hosted on a custom domain, select Custom.

If you select the Custom option, you must also specify the organization domain name.

6. Click Save. You will be redirected to the Salesforce authentication webpage.

On the Salesforce authentication webpage, enter credentials of the Salesforce user and click Log in. The specified user must be granted permissions to read user data.

As soon as the IdP settings are successfully configured, you can start adding users to Veeam Backup for Salesforce. Consider that the Veeam Backup for Salesforce session time out is 60 minutes. If the session is expired, you must log in to Veeam Backup for Salesforce using the local administrator credentials once again, and continue adding users for the next 60 minutes.