I have Multi-Provider Single Sign-on configured on my org, result of this is an additional button appearing on the login page as below. I wasn't expecting that, thought that user will be automatically logged in without additional step with selecting IDP as it was when I had single SSO configured.

Buttons to selects IDP

And my question is, how the authentication interaction can inform the Salesforce org which IdP to use? How can I avoid this additional step?

  • I don't use Multiple SSO but it would seem to me the SF org knows which to use based on the button that is clicked. I would not think you could remove that step for this very reason. – Eric Nov 19 '16 at 22:43
  • Dan, did you find any solution for this scenario? The problem is, since we are using trialforce orgs (cloudforce.com domain) and that login form isn't showing Identity Service buttons for logging in through AD. – Simon Feb 2 '18 at 14:46

When you have a choice of where to go, you have to choose. This applies to both the Salesforce option of logging in, as well as the IdP-initiated method of logging in. For example, if you set up https://salesforce/ to redirect to an ADFS server with a single Trusted Party and Kerberos authentication, then it's possible for the IdP to directly log in the user when they visit a bookmark directly, no interaction required.

If the ADFS server has multiple Trusted Parties, the user can still be logged in automatically, but they have to choose a destination. The same is true for Salesforce. If you only have one login option, you'll automatically be sent to the IdP, authenticated by Kerberos, and logged in without any additional effort. Otherwise, again, the user has to choose. Keep in mind that if you only want to use IdP-initiated login, you don't need to enable multiple authentication methods.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.