We have a custom portal in which there are links to some salesforce pages which are part of a customer community.

Users have to be logged into the custom portal in order to access salesforce(custom portal has LDAP authentication). We have used SAML to implement SSO between the custom portal and the salesforce customer community.

My Question is, in this case when users are logged in and when they click any of these links(pages) of salesforce customer community will the SSO be identity provider initiated(from the custom portal side?) or will be initiated by service provider(salesforce?).

Custom Portal is the Identity Provider and salesforce is the service provider.

This could a basic foundation question but i keep getting confused between the both.

Any help or clarity on whats service provider initiated vs whats identity provider initiated would be helpful

1 Answer 1


According to me, it is identity provider initiated flow.

User is already logged in into Salesforce after authentication from LDAP.

After that, user is trying access links of Customer Community, so it already has user authentication information (SAML assertion) which is ready to pass to Service Provider.

identity flow

Also, refer Identity Providers and Service Providers


  1. The user tries to access a service provider already defined in Salesforce.
  2. Salesforce sends a SAML response to the service provider.
  3. The service provider identifies the user and authenticates the certificate.
  4. If the user is identified, the user’s logged in to the service provider.

There is an excellent video on this.

Introduction to SAML - Chalktalk on what is it, how it is used

  • Thanks Santanu! Thats where my confusion starts. so in this case custom portal is the identity provider. when a link inside salesforce is clicked. salesforce customer community will check if the user is authenticated, if not will send a SAML request to identity provider. Is this not service provider(salesforce) initiated?
    – RedDevil
    Commented Jan 2, 2018 at 6:20
  • Just have a look into video you can understand in a better way. If user is not authenticated or user directly accesses Salesforce information then service provider will initiate the flow. Here user is already authenticated, so IdP will send valid authentication information during the calling. Commented Jan 2, 2018 at 6:36
  • Got the answer i needed thanks! The video was also helpful.
    – RedDevil
    Commented Jan 3, 2018 at 6:52
  • The right answer is that it depends on the format of the link to SF community page. If the link is not modified, i.e. you're clicking on somecommunity.secure.force.com/some/page/that/requires/… , that will be service provider-initiated SSO. Here's a diagram: ibm.com/developerworks/websphere/library/techarticles/1505_pal4/…
    – identigral
    Commented Jan 20, 2018 at 22:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .