Service accounts with Salesforce and Okta SAML for everything else

Question

How are people using Okta or other SSO providers to manage both service accounts and user accounts? For user accounts I'm clear on configuring SAML. For Service Accounts, how are you then disabling SAML auth for them either at the user or profile level?

I've searched a bunch for it but not entirely clear on selectively disabling SAML authentication. I think its only available for SSO or delegated auth right?

Thanks, BY

Answer 1

Assuming you're inquiring about SF as a service provider and SAML as a protocol, a simple workaround/hack is to disable SSO at the user level like so

1. When you set up SSO, use Federation ID as the attribute on SF User object that links users with their Salesforce org and the external identity provider.
2. Make Federation ID be blank or bogus value for service accounts in SF that shouldn't be able to sign in via SSO

https://developer.salesforce.com/docs/atlas.en-us.identityImplGuide.meta/identityImplGuide/identity_quickstart_fedID.htm