I have completed Mydomain set up and Single Sign-On set up in one of our Sandboxes and waiting for the IDP to complete their setup.


  1. Meanwhile how do I make sure the users are authenticated using their salesforce Username/Password rather than relying on the directory.

  2. Once the setup is complete on both ends how do I make specific profile/users to bypass authentication via the directory. I want them (for example, API only User) to logon with their Salesforce User Name/Password.

1 Answer 1


You can use both SAML SSO and normal SF username/password authentication at the same time, enabling SSO does not disable the usual authentication.

If you want to disable normal username/password login I believe you have to setup delegated authentication for a profile and point it's authentication url at a non existant url or one that always returns no.

Also, to answer a question in the comments, preventing login from login.salesforce.com won't help, this can be overridden with a url parameter.

  • Thanks Steve, I have an option in mind ... how about Checking "Prevent login from login.salesforce.com" checkbox for the Login Policy under "My Domain". This essentially forces all the users to type the My Domain Url which when setup with SSO would redirect them to the SSOLogin Page. Will this help?
    – KaLi
    Apr 25, 2013 at 6:57
  • You know, I don't actually know the answer to that. I think it might work. Apr 25, 2013 at 7:42
  • @sKaLiDhAsAn did you find an to that question? I am in a similar situation!
    – LVS
    Jan 18, 2014 at 16:23
  • @LVS Hi guys - can you post the solution you found out for this issue
    – Jaguar
    Jun 21, 2016 at 17:38
  • @Jaguar this was a while ago but I think we changed our policy instead. If I had more info now I'd add it
    – LVS
    Jun 21, 2016 at 18:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .