We have implemented Federated SSO for all our users with our Identity management and got stuck with few API users who interact with salesforce with API only, how can we exclude certain users from SSO and use default login. As far i have read the details only Delegated SSO lets me exclude users and for Federated SSO i dont have option to exclude specific users (Its either all or none). Can anyone tell their experiences or best practices for API users in Federated SSO
1.Make sure your API users does not have Federated Id populated .In other terms leave that as blank .
2.In My domain make sure , Prevent login from https://login.salesforce.com option is unchecked so users can use login.salesforce.com to login .
Thanks for comments and inputs, figured out finally! Below setting in SSO only prevents user logins through UI and our API logins remains unaffected, i.e even after enforcing 'Prevent login from test.salesforce' we are still able to make API calls to that end point, i believe this setting is not applicable to API calls and we able to use salesforce username password for the oAuth flow for the connected app. So i believe its safe to say that 'UI logins' are SSO enforced by Federated SSO but API logins can still be used with salesforce credentials.
Hope salesforce can mention this in any documentation of help text next time for others not to get confused