I was going throught the salesforce documentation for the SAML Assertion Flow and I did not understand the following point. Can someone please explain this:

To exchange a SAML assertion for an access token, your client must obtain or generate a valid SAML response and POST it to the token endpoint.

The method of obtaining this response is up to the client to determine.

How can I determine the method to obtain the SAML response?

Also, where can I get complete SAML request example that needs to be sent?

3 Answers 3


All that means is that your Identity Provider is responsible for generating the SAML Response (also called the SAML assertion).

To use the SAML or SAML Bearer Oauth flows you must have an external Identity Provider that has been configured for SSO in Salesforce. Commonly, this would be the same identity provider that users use when they SSO in.

Some examples would be Okta, ADFS, PingIdentity, etc.


Well, SAML is a way to facilitate Single Sign-On (SSO). Using SSO means you should have an external SAML Service Provider that can take a SAML assertion and get the response you need.

It's hard to tell you exactly what you need to do here, because that will depend on the specifics of the Service Provider your organization is using. It comes down to "you need to read the documentation of the system you're using".

If you don't have such a SAML Service Provider, then you should use a different authentication flow.


Salesforce supports two SAML-for-oAuth flows: one standardized in RFC 7522 and the other a very similar but proprietary to SF flavor thereof. The first flow is referred to as oAuth 2.0 SAML 2.0 Bearer Assertion by SF docs, second one is simply "SAML Assertion Flow":

In either flow, obtaining a SAML assertion and making sure that it has the right content is between your app/client and your SAML identity provider (issuer of the assertion), both of these entities being outside of Salesforce. Therefore the answer to your question is "it depends on the capabilities of your app and/or identity provider".

The SAML-for-oAuth flow isn't used much. For server-to-SF API calls, we recommend you look into JWT bearer flow.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .