Configure RSA Cloud Authentication Service

1. Sign into RSA Cloud Administration Console.
2. Enable SSO on My Page by accessing the RSA Cloud Administration Console > Access > My Page > Single Sign-On (SSO).
3. Enable two-factor authentication by using Password and Access Policy.
4. Navigate to Applications > My ApplicationsàAdd an application and click Create From Template.
5. Click Select against OIDC.
6. On the Basic Information page, enter the name for the application in the Name field.
7. Click Next Step.
8. Choose the required option on the Authentication page and click Next Step.       
9. Under Connection Profile, provide the following details:
10. 1. Authorization server Issuer URL is auto-populated. This URL is used in Salesforce to form the Callback URL, Token endpoint URL, and Authorize endpoint URL.
    2. The Redirect URL is obtained from Salesforce (see the next section).
    3. Copy the Redirect URL to the Connection URL.
    4. Provide a Client ID.
    5. Select a Client Authentication Method.
    6. Provide a client secret or generate it.
    7. Provide the scope as OpenID (scopes should be added in advance. See the Notes section).                                           
    8. Click Save and Finish.
    9. Click Publish Changes.

Notes

To add scopes, click Access > OIDC Claims & Scopes.

Configure Salesforce
Perform these steps to configure Salesforce.

1. Sign into Salesforce admin console. https://login.salesforce.com
2. Click Switch to Lightning Experience if you are using Salesforce Classic.                             
3. Click the gear icon in the upper-right corner and click Service Setup.                                                          
4. In the left pane, click Identity > Auth Providers and in the right pane, click New.           
5. Perform the following steps:
   1. For the Provider Type, select OpenID Connect.
   2. Enter the Name for the provider.
   3. Enter the URL suffix, which is used in the client configuration URLs. 
   4. For Consumer Key, use the Client ID from the RSA connector  configuration.
   5. For Consumer Secret, use the Client Secret from the RSA connector  configuration.
   6. For Authorize Endpoint URL, enter the Authorization Server Issuer URL from the RSA connector. Make sure that /auth is appended at the end.
   7. For Token Endpoint URL, enter the Authorization Server Issuer URL from the RSA connector. Make sure that /token is appended at the end.
   8. For User Endpoint URL, enter the Authorization Server Issuer URL from the RSA connector. Make sure that /userinfo is appended at the end.
   9. Click Automatically create a registration handler under Registration Handler.
   10. Search for the administrator in Execute Registration As.
   11. Click Save.                                                                                                                                                                                    
6. Click the Registration Handler link and edit the file. This code can be changed according to the requirement.                                                                                                                                                                                         Code Snippet

   //TODO:This autogenerated class includes the basics for a Registration
   //Handler class. You will need to customize it to ensure it meets your needs and
   //the data provided by the third party.
    
   global class AutocreatedRegHandler1662762939351 implements Auth.RegistrationHandler{
   global User createUser(Id portalId, Auth.UserData data){
   //The user is authorized, so create their Salesforce user
   User u = new User();
   String username = data.identifier;
   List<User> userList = [Select Id, Name, Email, UserName From User Where ( UserName =: username) AND isActive = true ];
   if(userList != null && userList.size() > 0) {
   u = userList.get(0);
   }
   return u;
   }
    
   global void updateUser(Id userId, Id portalId, Auth.UserData data){
   User u = new User(id=userId);
   update(u);
   }
    
   }  

7. Copy the Callback URL and use it as the Redirect URL in the connector (in RSA).
8. Click My Domain under Company Settings.
9. Under Authentication Configuration, click edit and select the auth provider created.
10. Click Save.