Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It only takes a minute to sign up.
Sign up to join this community
I have Multi-Provider Single Sign-on configured on my org, result of this is an additional button appearing on the login page as below. I wasn't expecting that, thought that user will be automatically logged in without additional step with selecting IDP as it was when I had single SSO configured.
And my question is, how the authentication interaction can inform the Salesforce org which IdP to use? How can I avoid this additional step?
When you have a choice of where to go, you have to choose. This applies to both the Salesforce option of logging in, as well as the IdP-initiated method of logging in. For example, if you set up https://salesforce/ to redirect to an ADFS server with a single Trusted Party and Kerberos authentication, then it's possible for the IdP to directly log in the user when they visit a bookmark directly, no interaction required.
If the ADFS server has multiple Trusted Parties, the user can still be logged in automatically, but they have to choose a destination. The same is true for Salesforce. If you only have one login option, you'll automatically be sent to the IdP, authenticated by Kerberos, and logged in without any additional effort. Otherwise, again, the user has to choose. Keep in mind that if you only want to use IdP-initiated login, you don't need to enable multiple authentication methods.
