SSO with Salesforce as indentity Provider and Portal users

[JSBrian]

I am trying to do the same thing ... where is this located, the app ID.  Are you creating a new Service Provider?

 String idpStart = '/idp/login?app=0spE0000000GmgD'; // IdP initated URL provided by SFDC

[jhenny]

Yes its provided automatically in the SP detail page when you create a new SP.

[JSBrian]

Thank you for the quick response.  I have been searching everywhere for a solution.  If you don't mind I'd like to recap what we are trying to do to make sure it is the same.

Right now I have Idp setup and I have a Service Provider setup for Google Mail.  It works as expected, the user goes to google and they get redirected back to the Issuer URL, they login and are sent to gmail.  If the user logs in to SFDC using the issuer url and they click a gmail link inside of Salesforce they pass right into google already logged in.

I have portal users who this doesn't work for.  So based on this solution I would create a login page as you have posted and then direct all user to that page to login and it will handle if they are portal or not or is this only for portal users to login.  For the google example would I alter the Sign in page url from the ttps://mydomain.my.salesforce.com/idp/endpoint/HttpRedirect to the page created?

Sorry for so many questions, trying to wrap my head around this.  I appreciate it.

[24kb]

I know this posting is old, but just wondering if it works since I have a related requirement.

I assume this controller and page are on the IDP org and where Sites is enabled.

And the SP in this case from what I've read is a Portal (with Sites).

What is the configuration on the SP to point to the VF on the IDP - is it simply a VF set up as the SP Sites Active Home Page

that does nothing but redirect to the VF on the IDP?

Apologies, but a bit confused on what this entails.

[chuckmortimore]

Instead of making the redirect the Active Home Page, I'd put the redirect logic in your Un-Authorized controller, or Login page for the SP