Configure Salesforce IdP for FedRAMP Single Sign-on

To configure Salesforce as your identity provider while using single sign on, configure the appropriate settings for your app integration.

Refer also to Salesforce's Integrate Service Providers as Connected Apps with SAML 2.0 documentation Salesforce's Integrate Service Providers as Connected Apps with SAML 2.0 documentation.

Log in to Salesforce.
Navigate to Setup → Identity → Identity Provider. If your org is not enabled as an IdP, click Enable Identity Provider, then click Save.
Navigate to Setup → Apps → App Manager.
Click New Connected App.
In the Basic Information section, enter a Connected App Name and Contact Email.
In the Web App Settings, select Enable SAML. The SAML options will appear.
In the ACS URLs field, enter any URL (it will be replaced with the correct parameter later on).
Enter any value in the Entity Id field.
Set the Subject Type to Email.
Set the Name ID Format to email address.
Set the Signing Algorithm for SAML Messages to SHA256.
Click Save.
(Optional) For an SP-Initiated SSO, note the SP-Initiated POST Endpoint URL.
Navigate to Setup → Identity → Identity Provider.
In the Details section, note the Issuer. This is the Identity Provider Issuer in the Own Data Platform.
Click Download Certificate.
Enter these values in the corresponding fields in the Own Data Platform.
(Optional) To enable SP-Initiated sign in, enable the SP-Initiated checkbox, copy the SP-Initiated POST Endpoint URL value from Salesforce and paste it into the IdP SSO URL field.
Click Next. It may take a few minutes to verify your settings. Once your settings are verified, the IdP Parameters are displayed.
In Salesforce, go to Setup → Apps → App Manager.
Select the newly created Connected App and click Edit.

Enter the IdP Parameters from the Own Data Platform in the corresponding fields.