I'm looking into implementing SSO for customer community. I've been reading the documentation on SSO implementation using either delegated or federated authentication. I have not done SSO before so I'm trying to understand what technical considerations there are between delegated and federated authentication? From what I read so far, federated using SAML is OOB, but delegated authentication has to be requested to be turned on. It also does appear that delegated authentication will work with community licenses. However, are there technical limitations and considerations on which method is used? I don't want to select federated using SAML and then realize I can't use that because of xyz reason.

Any feedback is appreciated.

  • If you are using community for customers then use Auth Provider, so that customers can login via, Facebook, google or twitter. Why should you use Delegated Authentication? Feb 16, 2018 at 15:46
  • Thanks for the quick response. Being completely new to SSO, what I've seen so far was using deleted or federated. Are there any examples of using Auth Provider? What's involved? I have an external service that authenticates users and that is the service I want to use to authenticate the community users and login them straight into the community.
    – Dman100
    Feb 16, 2018 at 15:54

1 Answer 1


According to your UseCase (external service first authenticates users and those users will automatically logged in to Salesforce Community).

You need to use Authentication Providers.

An authentication provider lets your users log in to your Salesforce org using their login credentials from an external service provider. Salesforce provides authentication providers for apps that support the OpenID Connect protocol, such as Google, Facebook, Twitter, and LinkedIn. For apps that don’t support OpenID Connect, Salesforce provides an Apex Auth.AuthProviderPluginClass abstract class to create a custom authentication provider.

Refer External Authentication Providers

Saleforce supports following auth providers:

  • Facebook
  • Google
  • LinkedIn
  • Microsoft Access Control Service
  • Salesforce
  • Twitter
  • Janrain
  • Amazon
  • Microsoft Azure AD
  • Any service provider who implements the OpenID Connect protocol
  • Any service provider who supports OAuth but not the OpenID Connect protocol

Refer these videos:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .