We have Federated Authentication implemented for our SSO and therefore a separate set of password policies are being applied from the client app. I found this SF article but it is only referring to Delegated Authentication, which confirms that Salesforce does not enforce anything around the password.

Just wanting to be 100% sure that the same is applied for Federated Auth. I believe so because in comparing policies between SF and the client app, SF has the stricter policy and yet log ins are permitted. If there is any documentation out there, or from your experience you can confirm, it would be appreciated.


Salesforce can't enforce password policies for Federated Authentication, because it never sees the password (or even the username!) of the user being authenticated. The authentication is handled entirely by the authentication server, which then provides Salesforce with a unique identifier for that user (the Federation ID) along with a signature that proves the veracity of the assertion, along with custom properties that may be also be sent.

| improve this answer | |
  • Would've thought so but best to hear it from an expert. Thanks mate – Francis A. Dec 12 '19 at 5:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.