Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

We need to set up Federated SSO and make sure that users can't login using the standard login page (login.salesforce.com).

One way that I know of doing this is, set up mydomain and force users to login using that. Also, Federated IDs have to be populated on each user.

  • For users who do not have Federated IDs populated, will they be able to log in? Would they use Salesforce usernames/pwds?
  • Should we try another (better?) approach?

Thanks! :)

share|improve this question
add comment

marked as duplicate by Mike Chale, Jesse Altman, jkraybill, Daniel Blackhall, eyescream Feb 27 '13 at 12:45

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

For users who do not have Federated IDs populated, will they be able to log in? Would they use Salesforce usernames/pwds?

Yes, they'd be able to login via login.salesforce.com with Salesforce usernames and passwords.

It is possible to prevent login via the standard login screen with a bit of a hack - you can ask support to turn on delegated authentication, then mark user profiles as using delegated auth. Delegated auth basically passes the details you supply to Salesforce to an authentication provider that you implement - this validates the credentials you supply and tells Salesforce whether you ar authenticated or not.

You can implement the service to always return a negative, or simply not implement a service at all (just make sure you point Salesforce to an address that is yours to control).

Federated SSO will continue to work, so your users will still be able to login.

There may be another option, because when you set up new users, there's the checkbox to send the email with their username and password - so if you didn't check that box, they'd never receive a password. I'm not sure about what you'd do with existing users though.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.