4

Google Apps offers an OpenID API that allows end users to securely sign in to third party web sites using their Google Apps user account.

I want to offer similar functionality - i.e. I want the users of my web site to be able to authenticate using their Salesforce account using OpenID.

Does Salesforce offer a similar API/functionality? I've checked the documentation and seen mentions of OpenID Connect API, but this seems to be in its early stages of development. I've also checked Salesforce's Identity Provider feature, but this seems more geared towards SSO scenarios (not quite sure though - please correct me if I am wrong).

|improve this question
  • Isn't OpenID essentially SSO, though? OepnID is just one standard way of implementing SSO; I sign in to Google and can then access other sites. Do you specifically need OpenID? – Mike Chale Jun 13 '13 at 13:28
  • No, I don't insist on OpenId. I've tried to go the SSO route as well: I've enabled the Identity Provider in Salesforce (first defined my domain), then I enabled Single Sign-on in Salesforce (SAML v2.0) and used the auto-generated certificate and issuer URL from the Identity Provider. What I'm not really clear is - does SSO set up like this really use Salesforce for user authorization? Also, is there some tutorial where I can see how all this works? – dasp Jun 13 '13 at 13:55
1

Salesforce can be used multiple ways for single sign-on:

  1. As an SAML-based Identity Provider (IdP)
  2. With OAuth

To be an IdP each customer organization would need to enable it which is probably impractical at best. I believe setting up OAuth is generally preferred for its simplicity and more widely used.

Edit Simplified explanation on SAML, added OAuth as an option.

|improve this answer
  • Thanks Mike. But in this case the user would have to enable Identity Provider for his Salesforce organization first, right? So this is more appropriate for enterprise in-house web apps that want to use Salesforce to authenticate users; not for general-purpose web app that seeks to provide OpenId-like authentication for customers belonging to different Salesforce orgs. Do you agree? – dasp Jun 14 '13 at 9:24
  • Correct; their org would have to be configured to run as an IdP. I'll update my answer. – Mike Chale Jun 14 '13 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.