Scenario - customer is logged into our web app, they click on create a ticket and are redirected to the salesforce community page as a user in salesforce with the same email as the web app, want to avoid any form of direct sign-up or password entry for customers.

  1. When the user clicks 'create a ticket', if they do not have a salesforce account with the web app email, create one via API in the web app.
  2. Authenticate the user against salesforce between API and Salesforce
  3. Redirect the now authenticated user into the salesforce community

What is the recommended solution for this authentication flow? I was looking into SSO with the WebApp as a custom identity provider

1 Answer 1


For creating a user account - you can call an out of the box REST API, it sounds like you're walking down this path. While you can (for example) create a single User object (record) in one REST call via an out of the box API, more than one record of one or more object type may need to be created for a user to be fully provisioned. You can use a Composite REST resource to combine multiple REST calls to out of the box APIs into one REST call. Alternatively you can create your own REST resource by developing the REST service/endpoint in Apex.

Once you have the user account created, you can implement single sign-on. There are two major, interoperable and industry-standard options: SAML or OpenID Connect. Since you aren't going to be rolling your own client for either option, this comes down to your comfort level with one of these and your application / development stack supporting your chosen approach.

Last but not least, you can combine user account provisioning with SSO via SAML by using Just-in-Time (JIT) provisioning. In this option you can use the payload of a SAML assertion to create your users on the fly the first time they try to log in from an identity provider. This eliminates the need to create user accounts in advance. The con of this approach is that you'll be limited to a very simple user account data model and minimal error handling. It might be good enough to start.

  • Is the implication here, the web app would have to implement the OpenID Connect Provider spec, IE, be an Oauth 2 server. Commented Feb 6, 2020 at 19:42
  • @salesforcerealtor Yes, your app would have to act as an OIDC Provider. With SAML, your app would have to act as the Identity Provider, similar deal. There are other options for authentication, sure. You asked for a recommendation and this is our recommendation. As an aside, this forum doesn't like broad, opinion-based Q&As because there's no "right" answer.
    – identigral
    Commented Feb 6, 2020 at 22:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .