I have a requirement where users need to log in to salesforce using external authentication provider. The configuration in Open-id authentication. I have created the connection in Auth.Providers along with all the required key, id, url and tokens. Salesforce has automatically created a registration handler. Using Test-Only Initialization URL, I have tested the connection and I have recieved the XML which states that the connection is working fine

Now, I need the users to log in using that provider and should be redirected to Home Page of Salesforce. How to do that? Please help.

Thank you in advance. Sastri


You need to Modify the app settings and set the app domain (or Home Page URL) to Salesforce.

Please follow below steps from the link below.


I have posted complete steps from above link

Complete these steps to configure an OpenID authentication provider.

Register your app, making Salesforce the app domain.

  • Define an OpenID Connect authentication provider in your Salesforce org.

  • Update your app to use the callback URL generated by Salesforce.

  • Test the connection.

Register an OpenID Connect App

Before you can configure a web app for your Salesforce org, you must register it with your service provider. The process varies depending on the service provider. For example, to register a Google app, Create an OAuth 2.0 Client ID.

Register your app on your service provider’s website.

Modify the app settings and set the app domain (or Home Page URL) to Salesforce. From the provider’s documentation, get the client ID, client secret, authorize endpoint URL, token endpoint URL, and the user info endpoint URL. Here are some common OpenID Connect service providers. Amazon Google PayPal

Define an OpenID Connect Provider in Your Salesforce Org

From Setup, enter Auth. Providers in the Quick Find box, and then select Auth. Providers | New. For the provider type, select OpenID Connect. Enter a name for the provider. Enter the URL suffix, which is used in the client configuration URLs. For example, if the URL suffix of your provider is MyOpenIDConnectProvider, your single sign-on URL is similar to https://login.salesforce.com/auth/sso/00Dx00000000001/MyOpenIDConnectProvider. For Consumer Key, use the client ID from your provider. For Consumer Secret, use the client secret from your provider. For Authorize Endpoint URL, enter the base URL from your provider. Tip TIP You can add query string parameters to the base URL, if necessary. For example, to get a refresh token from Google for offline access, use https://accounts.google.com/o/oauth2/auth?access_type=offline&approval_prompt=force. You need the approval_prompt parameter to ask the user to accept the refresh action so that Google continues to provide refresh tokens after the first one. Enter the token endpoint URL from your provider. Optionally, set the following fields. For User Info Endpoint URL, enter the URL from your provider. The Token Issuer field identifies the source of the authentication token in the form https: URL. If this value is specified, the provider must include an id_token value in the response to a token request. The id_token value isn’t required for a refresh token flow. If it is provided, Salesforce validates it. For Default Scopes, enter the scopes to send along with the request to the authorization endpoint. Otherwise, the hard-coded defaults for the provider type are used. See the OpenID Connect developer documentation for these defaults. For more information, see Use the Scope Parameter.

Optionally, select Send access token in header to have the token sent in a header instead of a query string. To direct callbacks to your subdomain instead of login.salesforce.com, select Use subdomain in callback URLs. For auth. providers created before Spring ’18, this setting isn’t enabled by default. You can enable this setting if you have My Domain deployed. If you create an auth. provider in Spring ’18 and later but don’t have My Domain deployed, this setting isn’t enabled. However, you can enable this setting after you deploy My Domain. When you create an auth. provider in an org with My Domain deployed, callback URLs direct to your subdomain by default, and you can’t disable the setting.

To avoid redirect URI mismatch errors, update your third-party app configuration to use the new URLs, and test social sign-on in a sandbox. Use the same subdomain in both the initialization and callback URLs.

Optionally, set the following fields. For Custom Error URL, enter the URL for the provider to use to report any errors. For Custom Logout URL, enter a URL to provide a specific destination for users after they log out, if they authenticated using the SSO flow. Use this field to direct users to a branded logout page or destination other than the default Salesforce logout page. The URL must be fully qualified with an http or https prefix, such as https://acme.my.salesforce.com. Tip TIP Configure single logout (SLO) to automatically log out a user from both Salesforce and the identity provider. As the relying party, Salesforce supports OpenID Connect SLO when the user logs out from either the identity provider or Salesforce. Select an existing Apex class as the Registration Handler class. Or click Automatically create a registration handler template to create an Apex class template for the registration handler. Edit this class later, and modify the default content before using it. Note NOTE A Registration Handler class is required for Salesforce to generate the single sign-on initialization URL. For Execute Registration As, select the user that runs the Apex handler class. The user must have the Manage Users permission. A user is required regardless of whether you’re specifying an existing registration handler class or creating one from the template. To use a portal with your provider, select the portal from the Portal dropdown list. For Icon URL, add a path to an icon to display as a button on the login page for a community. This icon applies to a community only. It doesn’t appear on the login page for your Salesforce org or domain created with My Domain. Users click the button to log in with the associated authentication provider for the community. Specify a path to your own image, or copy the URL for one of our sample icons into the field.

Click Save. Be sure to note the generated Auth. Provider ID value. You must use it with the Auth.AuthToken Apex class.

Several client configuration URLs are generated after defining the authentication provider.

Test-Only Initialization URL—Salesforce admins use this URL to ensure that the third-party provider is set up correctly. The admin opens this URL in a browser, signs in to the third party, and is redirected back to Salesforce with a map of attributes. Single Sign-On Initialization URL—Use this URL to perform SSO into Salesforce from a third party using its third-party credentials. The user opens this URL in a browser and logs in to the third party. The third party either creates a user or updates an existing user. Then the third party signs the user into Salesforce as that user. Existing User Linking URL—Use this URL to link existing Salesforce users to a third-party account. The user opens this URL in a browser, signs in to the third party, signs in to Salesforce, and approves the link. Oauth-Only Initialization URL—Use this URL to obtain OAuth access tokens for a third party. Users must authenticate with Salesforce for the third-party service to get a token. This flow doesn’t provide for future SSO functionality. Callback URL—Use the callback URL for the endpoint that the authentication provider calls back to for configuration. The authentication provider must redirect to the callback URL with information for each client configuration URL. Client configuration URLs support additional request parameters that enable you to direct users to log in to specific sites, obtain customized permissions from the third party, or go to a specific location after authenticating.

Update Your OpenID Connect App

After defining the authentication provider in your Salesforce org, go back to your provider and update your app’s callback URL. For Google apps, the callback URL is called the Authorized Redirect URI. For PayPal, it’s called the Return URL.

Test the SSO Connection

In a browser, open the Test-Only Initialization URL on the Auth. Provider Setup page. It redirects you to your provider’s service and asks you to sign in. You’re then asked to authorize your app. After you authorize, you’re redirected back to Salesforce.

  • Thank you for the concern over this issue. As I have mentioned in the question, I have created open id Configuration with the client. Now, I need the users to redirect to home page when logged in. I think I need to create some apex class. Can you please let me know an example apex class so that the user will be redirected to home page.
    – Sastri
    Dec 29 '18 at 15:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.