I have Multi-Provider Single Sign-on configured on my org, result of this is an additional button appearing on the login page as below. I wasn't expecting that, thought that user will be automatically logged in without additional step with selecting IDP as it was when I had single SSO configured.

Buttons to selects IDP

And my question is, how the authentication interaction can inform the Salesforce org which IdP to use? How can I avoid this additional step?

  • I don't use Multiple SSO but it would seem to me the SF org knows which to use based on the button that is clicked. I would not think you could remove that step for this very reason.
    – Eric
    Nov 19, 2016 at 22:43
  • Dan, did you find any solution for this scenario? The problem is, since we are using trialforce orgs (cloudforce.com domain) and that login form isn't showing Identity Service buttons for logging in through AD.
    – Simon
    Feb 2, 2018 at 14:46

1 Answer 1


When you have a choice of where to go, you have to choose. This applies to both the Salesforce option of logging in, as well as the IdP-initiated method of logging in. For example, if you set up https://salesforce/ to redirect to an ADFS server with a single Trusted Party and Kerberos authentication, then it's possible for the IdP to directly log in the user when they visit a bookmark directly, no interaction required.

If the ADFS server has multiple Trusted Parties, the user can still be logged in automatically, but they have to choose a destination. The same is true for Salesforce. If you only have one login option, you'll automatically be sent to the IdP, authenticated by Kerberos, and logged in without any additional effort. Otherwise, again, the user has to choose. Keep in mind that if you only want to use IdP-initiated login, you don't need to enable multiple authentication methods.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .