I`m new to SAML/SSO configuration and I was wondering if someone can point me in right direction. I have a requirement where I need to configure a third party app as a service provider (Salesforce to act as IdP). I have already shared my org certificate with this Third Party App engineers and in return, they have shared their ACS and entity URL with me. However, SSO is not working.


  1. Is 'Connected App' the only way to establish SSO in Salesforce?

  2. In a documentation shared by this Third Party app, they have given a standard SAML/XML response. Could we create a custom functionality (without using Connected App) to establish SSO?

  1. No...but it's the only way if you want to use out of the box identity provider pieces, incl. SAML

  2. Yes but you do not want to do this. Example of your own IdP in ApEx: https://github.com/salesforceidentity/saml-idp

Writing your own identity provider (even if possible in ApEx) is a very bad idea. It's going to penalize you forever because you'll be reinventing a wheel (more like reinventing a piece of the engine) and your wheel won't fit into the rest of SF framework.

| improve this answer | |

You will need to create a Connected App in Salesforce. From Setup -> Create -> Apps, scroll down to connected Apps and click "New". On the New Connected App page, look for the "Web App Settings". There's a checkbox to "Enable SAML". Whan you check that you will have access to the attributes you will need to use to get SAML based SSO running.

It's not easy setting this up, but the nice thing is when it's done you can control access to the connected App (and the service provider app) using Profiles and Permission sets.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.