I've one single sign on setting which need to be deployed every time upon scratch org creation. SSO has a JITHandler with it which is part of source and deployed to scratch org. I know that SSO settings can be deployed using metadata api/sfdx. But issue I am facing is deployment fails when I inclucde SSO settings with JIT Handler in the source. Forcefully, I've to put SSO tag in .forceignore #SSO configs **/samlssoconfigs/**
Below error comes when trying to push SSO Settings along with a JIT Handler

JITHandler already has Auth.SamlJitHandler interface implemented

global class DSEJistRegistrationHandler implements Auth.SamlJitHandler { private class JitException extends Exception{}

Not sure if this is a salesforce bug with SSO settings. Quick fix to this is to compile the class manually by going to dev console and saving or just use compile classes option on Apex Classes page in setup. and then create the SSO manually in Org. This is a repetitive task which needs to be automated now. I am hoping that this step can be avoided if this deployment issue is fixed.

  • 1
    Once the Apex code is pushed can you explicitly deploy the SSO setting using the CLI (naming the file on the CLI command itself "SFDX force:source:deploy -u alias -p path/to/ssodef-file") or does the .forceignore still prevent this? I am wondering if it is a simple bug in resolving push/deployment ordering.
    – Phil W
    Commented May 7, 2019 at 6:27
  • I figured out what's wrong. SSO meta file has all the tags with ApexClassId, ExecutingUserId, LoginURL specific to domain, etc. All these values will change for new scratch org. I don't think Salesforce will be able to resolve this deployment issue anytime soon. Commented May 7, 2019 at 8:56
  • 1
    Perhaps you will be able to write some Ant scripting using the sfdx CLI to work around this issue.
    – Phil W
    Commented May 7, 2019 at 13:40
  • 1
    @phil, I was able to deploy SSO after deploying main package and updating IDs and URLs in SSO source file using bash script. Commented May 9, 2019 at 12:22
  • 1
    @PhilW force:source:deploy does not consider .forceignore file and will deploy the code present on the path Commented May 9, 2019 at 12:29

1 Answer 1


I was able to deploy SSO setting by writing a bash script which will update SSO metadata with new IDs and URLs generated in new scratch org. I had to divide main package into two parts. One as the main package having all the metadata including SSO JITHandler and another one with SSO setting metadata. Script will deploy the main package first, then write the new IDs and URLs in a custom setting, then retrieve the data using SOQL query from SFDX CLI command. After successfully retrieve, script will update the SSO source file with new IDs and URLs. Once source file is updated successfully, SSO settings can be deployed using force deploy command with path given to SSO file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .