Why doesn't https://mydomain.my.salesforce.com/?login work when single signon is enabled?

Question

The Best Practices and Tips for Implementing Single Sign-On

states:

System admins must always be able to log in to Salesforce, even if SSO is enabled for their accounts. For example, you need a fallback in case your third-party authentication provider has an outage. You can always log in to Salesforce using the standard login page, which prompts for username and password. Access the standard login page by modifying the Salesforce URL. You can add login as a query string parameter, for example, https://northerntrailoutfitters-dev-ed.my.salesforce.com/?login. Or you can append login=true to the URL, for example, https://northerntrailoutfitters-dev-ed.my.salesforce.com/?login=true.

Yet when I use https://mydomain.my.salesforce.com/?login

• The standard SFDC login form appears
• Entering username/pw results in error: We can't log you in because you're only allowed to use single sign-on. For help, contact your Salesforce administrator.

My SAML identity provider is down. I can't login. Help!

Answer 1

Short answer:

When attempting https://mydomain.my.salesforce.com/?login, the user's profile (or permission set) has Is Single Signon Enabled = true

If you have somehow done this to Profile System Administrator and

• no other profile/user has Customize Application privileges or no other user w/ Customize Application privileges is logged in to undo (in Setup) the Is Single Signon Enabled=true
• and your IdP is offline

You'll be making a phone call to SFDC Support!

Longer answer

The doc also states...

We recommend that you don’t enable SSO for Salesforce admins. If your Salesforce admins are SSO users and your SSO server has an outage, they have no way to log in to Salesforce. Make sure that Salesforce admins can log in to Salesforce so that they can disable SSO if problems occur.

This is a bit misleading. You should not enable the Is Single Signon = true for Sysads but you certainly can enable a SAML SSO for system admins by configuring My Domain as shown below

If you enter https://mydomain.my.salesforce.com/?login=true in the browser, you will see:

and, assuming you remember your password, you can login and bypass the IdP.

So - you can:

• Set Is Single Signon Enabled = true for all users except Sysads (this prevents them from using the ?login=true URL param)
• Disable the Login Form in My Domain so no one worries about the username/pw anymore (the whole point of SSO/IdP)
• Still allow Sysads to login with http://mydomain.my.salesforce.com/?login=true to provide access to Setup in case an IdP is down or misconfigured.