I am trying to automate a mobile application in my organization which uses SAML based SSO authentication to allow any user to login to the app.

What I am trying to achieve is to perform an action in the app at API level by login on behalf of a particular user using python?

How can I achieve it?

  • This sounds like an XY problem. What are you trying to accomplish?
    – identigral
    Jul 18, 2019 at 18:36
  • I have a web application which uses salesforce as a backend to store data generated from user actions.I am trying to automate the user actions at API level but for which I need to first authenticate. The authentication method used by the application is SAML based SSO authentication. Usually, for a simple web application, we send username,password in a service call and create a user session so as to call other web services to prove that the request is coming from a valid user. But how i can I call any create this session for a web application which uses salesforce based SSO authentication? Jul 19, 2019 at 19:13

1 Answer 1


In Salesforce when you authenticate a user when signing in (via SSO or otherwise) to Salesforce web UI, you have certain protocols such as SAML available / required by Salesforce. When you authorize a caller at an API level, doing so does not require you to use the protocols from the user authentication scenario. Calling a Salesforce REST API is very straightforward with oAuth as the authorization protocol.

A number of Salesforce clients have been built in Python that encapsulate the authorization scenario for you. simple-salesforce is a popular Python client, it uses SF's SOAP API for authentication. Another one is django-salesforce, it's a higher-level abstraction that might work if you don't deal with Salesforce on a daily basis and prefer ORM to low-level Salesforce API stuff.

  • Thanks for your response. Calling a REST api with oauth requires username and password of the user whereas SSO does not require the username and password of the user. I am trying to achieve the second one wherein I will be able to authenticate a user by only sending a federation identifier which will uniquely identify the user. Jul 21, 2019 at 19:00
  • To generate a SAML assertion, you have to authenticate to the identity provider and that requires credentials, usually username and password. The alternative is for your client to act as its own SAML identity provider and generate your own SAML assertion. Doable but a lot more work than any other option.
    – identigral
    Jul 21, 2019 at 23:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .