I've been tasked with providing SaleForce SSO integrations with our Web Application.
We sell our Web App products to clients, some of which require SalesForce SSO Integration (Sync user account's between us and SF, etc..)

I'm a little lost with all the documentation available of SFs site! I suppose it's a good complaint when you consider some companies dont have enough!

Is it possible to achieve SSO using the SF Rest API?

Or is it only possible using Delegated or Federated Authentication?

I setup a test connected app and have some java code getting access_token back within our app by following this tutorial.

I also followed this tutorial and got it working.
I am a little confused as to how the Identity Provider works though; would I have to set my own Web App or SF up as this?


  • 1
    I'm not sure what you are asking: are you asking about using Salesforce as an identity provider (Salesforce authenticates external system,) or as a service provider (external system authenticates Salesforce login)? – Curious Blueprints Feb 7 '17 at 20:05
  • So someone hits a link in SalesForce to our app. We want to auto log them into our application then. Is it possible to pass some form of token that we can verify on our side? – Thomas Buckley Feb 8 '17 at 11:30

To achieve single sign-on with Salesforce as either identity provider or service provider, your application needs to implement one of the standard SSO/federation protocols supported by Salesforce. It can be then on-boarded to Salesforce using a standard procedure by creating a connected app https://help.salesforce.com/articleView?id=connected_app_create.htm&type=0

The advantage of doing so would be interoperability between your app and not just Salesforce but thousands of other potential partners. My recommendation of a protocol would be SAML 2.0 . OpenID Connect is another possibility but it's an emerging choice that isn't widely supported yet outside of Salesforce and some other large service providers.

Delegated auth is something different. The fist tutorial you went through uses oAuth protocol to authorize access of a client to Salesforce, not SSO. The second tutorial shows inbound SSO whereas it sounds like you want outbound (from Salesforce to your app).

Having integrated many an app with Salesforce, my advice is to think what type of interaction will your app's customers require from your app and their Salesforce org. Typically SSO will NOT be one of their use cases.


I know this question is a year and a half old at this time, but here's how this is supposed to work when trying to connect a web application to a Salesforce org who expects to use SSO for authorization that also wants to sync user accounts:

  1. You first create a Connected App for your web application.

  2. When you save the Connected App, it will have a ClientId assigned to it and a ConsumerSecret that you'll use for OAuth Authentication. When the two strings are combined and Base64Encoded, a Client Authorization Code is generated that your OAuth service can recognize at the Connected App end of things.

  3. Salesforce will act as the identity provider (idP) and the Salesforce org/instance will act as the identity Server (idS) that will initiate the call to your application.

  4. You'll want to install the free identity managed packages from the App Exchange that enables Connected Apps to provide user provisioning for syncing accounts with your application. The two apps are Salesforce Identity User Provisioning Connectors and Salesforce Identity User Provisioning Utils. You can optionally Create Your Own User Provisioning Flow.

  5. The syncing of accounts via user provisioning can be done using either the OAuth2 flow or a version of the SAML Assertion Flow that sits on top of OAuth2. Which to use will be entirely up to you. You'll want to read Authenticate Apps with OAuth which includes a section on the SAML Assertion Flow.

I hope this is helpful to anyone who might read this question in the future.


How I see it:

  1. SSO: When you want your laptop to auto-login to Salesforce if you're logged in using your office laptop.

  2. API: When you're logging into an internal custom mobile app that uses Salesforce to manage users and data.

I don't have enough knowledge to share any knowledge between federated and delegated. So I hope someone else can answer that point of yours.

As far as Identity part is concerned, this Trailhead should have you covered: https://trailhead.salesforce.com/en/identity_basics/identity_basics_product

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.