We have a Salesforce Customer Community site built with Aura components with many customizations. The landing page is public so doesn't require any authentication. However, if it detects user is not a Guest user, it uses their information to provide a more personalized experience with access to more (secured) content conditionally available on the landing page.

We use SSO Federated authentication using SecureAuth for our secured pages such as their user profile and other content.

The problem we are trying to solve is to keep the Community landing page "aware" that the user is still logged in for a period of time EVEN AFTER closing all browsers. We have configured our IdP in SecureAuth to keep the user authenticated in this manner but the Salesforce Communities site seems to lose it's awareness that the User is already authenticated when they return to the landing page (isGuest == true).

If the user click's on a link to a page requiring authentication, the user is redirected to the IdP where it automatically redirects them back to the Community without them having to re-enter their credentials (as long as they are still authenticated).

I want to be able to detect the user is still authenticated via SSO when they come back to our public landing page WITHOUT them first having to click a link requiring the authentication again to SecureAuth.

Is anyone aware of how I could accomplish this?

2 Answers 2


The only way I can think to accomplish this, and I have no way of guaranteeing this will work, is to:

  • Configure the URL to point directly to SecureAuth login url
  • Configure SecureAuth to redirect to your community whether or not they are currently logged in (bypass login screen at this stage)
  • Configure the login link to push back to SecureAuth, maybe to a different endpoint then where you send the community URL, that will then prompt a login screen.

All 3 of your scenarios would likely work however would require significant changes so I went with a different solution:

In my Community code, keep track of when the user last logged in.

If elapsed-time since user last logged in < the SecureAuth IdP session lifetime,

And If the user is not logged into the community,

Store the page the user is trying to access in localStorage.

Re-initiate the authentication redirect with SecureAuth.

In callback from SecureAuth, redirect user back to page they were trying to access in step 3.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .