We have enabled SSO for our users. How can I prevent users from using salesforce login(login.salesforce.com) if they know saleforce password from before setting up sso or if they reset their password via forgot password link? I cannot use the My domain login policy setting to restrict users from logging in via login.salesforce.com as I want admins to still login via standard salesforce login. Any help on this is appreciated.
You can always have admins login using direct URL even when the Prevent login from ... is enabled. The way to do so is to append a query parameter login in the login URL (example below) where admins can still use their Salesforce username and password.
https://mydomain.my.salesforce.com/?login
You can find more details here.
It's advisable that you expire passwords for all users so that even if they can get access using the query parameter, they won't be able to login. But if for any reasons any User has access to this URL, and that they have their Salesforce password known to them, they can still login using their Salesforce username/password.
-
Thank you Jayant. Will the fall back url .../login work for actual users too if they know their salesforce password? – sfdcdev Mar 26 '19 at 10:44
-
Yes. To avoid that situation, its best that you expire password for all users before restricting the login. I have updated my answer to reflect that. – Jayant Das Mar 26 '19 at 13:51
-
Jayant, if users get to know the ?/login url they can reset the password via forgot password link and can login to sandbox with out going through SSO. anyway we can prevent that flow? – sfdcdev Mar 28 '19 at 6:17
-
Make sure such Users have
Is Single Sign-On Enabledpermission set on their profile. In that case even if they can reach to the login page, but they won't be able to reset their password. I will recommend you take a look at the doc here – Jayant Das Mar 28 '19 at 13:26 -
But that permission is not available unless you have Delegated Authentication enabled and we don't have delegated authentication showing up in the single sign on page. – sfdcdev Mar 28 '19 at 14:19
