diff --git a/Gemfile b/Gemfile
index 1282ff0e20d35b1edf2589f6663d05f6ff9f2e43..1c77f8e9a8b91f0bc04079291fea569e5fe2abe0 100644
--- a/Gemfile
+++ b/Gemfile
@@ -43,6 +43,7 @@ gem 'omniauth_crowd', '~> 2.2.0'
gem 'omniauth-authentiq', '~> 0.3.3'
gem 'omniauth_openid_connect', '~> 0.3.0'
gem "omniauth-ultraauth", '~> 0.0.2'
+gem 'omniauth-salesforce', '~> 1.0.5'
gem 'rack-oauth2', '~> 1.9.3'
gem 'jwt', '~> 2.1.0'
diff --git a/Gemfile.lock b/Gemfile.lock
index 9b1a036030a8c0befa216fa1dea641fb6180eb62..ddff7e56968d2e767d946788a7c30d84e517ac7a 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -553,6 +553,9 @@ GEM
omniauth (~> 1.9)
omniauth-oauth2-generic (0.2.2)
omniauth-oauth2 (~> 1.0)
+ omniauth-salesforce (1.0.5)
+ omniauth (~> 1.0)
+ omniauth-oauth2 (~> 1.0)
omniauth-saml (1.10.0)
omniauth (~> 1.3, >= 1.3.2)
ruby-saml (~> 1.7)
@@ -1127,6 +1130,7 @@ DEPENDENCIES
omniauth-google-oauth2 (~> 0.6.0)
omniauth-kerberos (~> 0.3.0)
omniauth-oauth2-generic (~> 0.2.2)
+ omniauth-salesforce (~> 1.0.5)
omniauth-saml (~> 1.10)
omniauth-shibboleth (~> 1.3.0)
omniauth-twitter (~> 1.4)
diff --git a/changelogs/unreleased/57077-add-salesforce-omniauth.yml b/changelogs/unreleased/57077-add-salesforce-omniauth.yml
new file mode 100644
index 0000000000000000000000000000000000000000..ebd0637ddacfd4ddc2d04621216ec8c365196e52
--- /dev/null
+++ b/changelogs/unreleased/57077-add-salesforce-omniauth.yml
@@ -0,0 +1,5 @@
+---
+title: Resolve Salesforce.com omniauth support
+merge_request: 27834
+author:
+type: added
diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example
index 2f822805b250b0c1c3b9e3f75575e5fcc7a370aa..bff809b76614213b96eb28c152ad781c4c5e4090 100644
--- a/config/gitlab.yml.example
+++ b/config/gitlab.yml.example
@@ -940,6 +940,10 @@ test:
app_id: 'YOUR_CLIENT_ID',
app_secret: 'YOUR_CLIENT_SECRET',
args: { scope: 'aq:name email~rs address aq:push' } }
+ - { name: 'salesforce',
+ app_id: 'YOUR_CLIENT_ID',
+ app_secret: 'YOUR_CLIENT_SECRET'
+ }
ldap:
enabled: false
servers:
diff --git a/doc/integration/img/salesforce_app_details.png b/doc/integration/img/salesforce_app_details.png
new file mode 100644
index 0000000000000000000000000000000000000000..00e66f07282fb65ad632dbf91e9133606e30800b
Binary files /dev/null and b/doc/integration/img/salesforce_app_details.png differ
diff --git a/doc/integration/img/salesforce_app_secret_details.png b/doc/integration/img/salesforce_app_secret_details.png
new file mode 100644
index 0000000000000000000000000000000000000000..fad2a4a1f97d0d53ef7408e23b2383a3907b30bd
Binary files /dev/null and b/doc/integration/img/salesforce_app_secret_details.png differ
diff --git a/doc/integration/img/salesforce_oauth_app_details.png b/doc/integration/img/salesforce_oauth_app_details.png
new file mode 100644
index 0000000000000000000000000000000000000000..a5fb680cca69f9c2a73987e55343d38a909fedf2
Binary files /dev/null and b/doc/integration/img/salesforce_oauth_app_details.png differ
diff --git a/doc/integration/omniauth.md b/doc/integration/omniauth.md
index ef1f2df77f8b00c9f00ce6d7206012e6f034238d..a13e9f73f480f29a141c5c43c18a703daf8440ae 100644
--- a/doc/integration/omniauth.md
+++ b/doc/integration/omniauth.md
@@ -35,6 +35,7 @@ contains some settings that are common for all providers.
- [JWT](../administration/auth/jwt.md)
- [OpenID Connect](../administration/auth/oidc.md)
- [UltraAuth](ultra_auth.md)
+- [SalesForce](salesforce.md)
## Initial OmniAuth Configuration
diff --git a/doc/integration/salesforce.md b/doc/integration/salesforce.md
new file mode 100644
index 0000000000000000000000000000000000000000..18d42486fd6d0216853bb7eb03ab3c64ab5ca726
--- /dev/null
+++ b/doc/integration/salesforce.md
@@ -0,0 +1,79 @@
+# SalesForce OmniAuth Provider
+
+You can integrate your GitLab instance with [SalesForce](https://www.salesforce.com/) to enable users to login to your GitLab instance with their SalesForce account.
+
+## Create SalesForce Application
+
+To enable SalesForce OmniAuth provider, you must use SalesForce's credentials for your GitLab instance.
+To get the credentials (a pair of Client ID and Client Secret), you must register an application on UltraAuth.
+
+1. Sign in to [SalesForce](https://www.salesforce.com/).
+
+1. Navigate to **Platform Tools/Apps** and click on **New Connected App**.
+
+1. Fill in the application details into the following fields:
+ - **Connected App Name** and **API Name**: Set to any value but consider something like `<Organization>'s GitLab`, `<Your Name>'s GitLab`, or something else that is descriptive.
+ - **Description**: Description for the application.
+
+ 
+1. Select **API (Enable OAuth Settings)** and click on **Enable OAuth Settings**.
+1. Fill in the application details into the following fields:
+ - **Callback URL**: The call callback URL. For example, `https://gitlab.example.com/users/auth/salesforce/callback`.
+ - **Selected OAuth Scopes**: Move **Access your basic information (id, profile, email, address, phone)** and **Allow access to your unique identifier (openid)** to the right column.
+
+ 
+1. Click **Save**.
+
+1. On your GitLab server, open the configuration file.
+
+ For omnibus package:
+
+ ```sh
+ sudo editor /etc/gitlab/gitlab.rb
+ ```
+
+ For installations from source:
+
+ ```sh
+ cd /home/git/gitlab
+ sudo -u git -H editor config/gitlab.yml
+ ```
+
+1. See [Initial OmniAuth Configuration](omniauth.md#initial-omniauth-configuration) for initial settings.
+
+1. Add the provider configuration:
+
+ For omnibus package:
+
+ ```ruby
+ gitlab_rails['omniauth_providers'] = [
+ {
+ "name" => "salesforce",
+ "app_id" => "SALESFORCE_CLIENT_ID",
+ "app_secret" => "SALESFORCE_CLIENT_SECRET"
+ }
+ ]
+ ```
+
+ For installation from source:
+
+ ```
+ - { name: 'salesforce',
+ app_id: 'SALESFORCE_CLIENT_ID',
+ app_secret: 'SALESFORCE_CLIENT_SECRET'
+ }
+ ```
+1. Change `SALESFORCE_CLIENT_ID` to the Consumer Key from the SalesForce connected application page.
+1. Change `SALESFORCE_CLIENT_SECRET` to the Client Secret from the SalesForce connected application page.
+ 
+
+1. Save the configuration file.
+1. [Reconfigure GitLab]( ../administration/restart_gitlab.md#omnibus-gitlab-reconfigure ) or [restart GitLab]( ../administration/restart_gitlab.md#installations-from-source ) for the changes to take effect if you
+ installed GitLab via Omnibus or from source respectively.
+
+On the sign in page, there should now be a SalesForce icon below the regular sign in form.
+Click the icon to begin the authentication process. SalesForce will ask the user to sign in and authorize the GitLab application.
+If everything goes well, the user will be returned to GitLab and will be signed in.
+
+NOTE: **Note:**
+GitLab requires the email address of each new user. Once the user is logged in using SalesForce, GitLab will redirect the user to the profile page where they will have to provide the email and verify the email.
diff --git a/spec/features/oauth_login_spec.rb b/spec/features/oauth_login_spec.rb
index f4105730402a6e3f9ed9216d008da1470ae560ed..5ebfc32952d1aa80b3068f37bce7611f6fc802d7 100644
--- a/spec/features/oauth_login_spec.rb
+++ b/spec/features/oauth_login_spec.rb
@@ -14,7 +14,7 @@ def stub_omniauth_config(provider)
end
providers = [:github, :twitter, :bitbucket, :gitlab, :google_oauth2,
- :facebook, :cas3, :auth0, :authentiq]
+ :facebook, :cas3, :auth0, :authentiq, :salesforce]
before(:all) do
# The OmniAuth `full_host` parameter doesn't get set correctly (it gets set to something like `http://localhost`