How can an Apex developer obtain the id_token from a Salesforce SSO to an IDP (e.g. Azure AD)?

It seems that the Salesforce Apex implementation of OIDC (and SSO in general) is lacking some basic functionality.

First, going by the documentation on the OAuthToken page: https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_AuthToken.htm

If you are using an OpenID Connect authentication provider, an id_token is not required in the response from the provider. If a Token Issuer is specified in the Auth. Provider settings and an id_token is provided anyway, Salesforce will verify it.

The access token can be used to call the /userinfo endpoint, but the id_token is the preferred mechanism for conveying user identity information and can contain additional claims. There seems to be no way to retrieve the id_token that was returned by the Authorization Server / IDP.

  • Why do you need to retrieve it, what are you trying to accomplish?
    – identigral
    Oct 3, 2021 at 16:06
  • @identigral: The id_token contains additional claims for the user that are needed. It will also be used as part of an integration to establish the user context. There are other use cases and I see this question asked, but never answered. Seems to be lacking.
    – acarlon
    Oct 3, 2021 at 20:37
  • 2
    It's on the product roadmap. Custom auth provider is the way to go for now.
    – identigral
    Oct 3, 2021 at 20:54
  • @identigral - great thanks, that is the most helpful answer I have had :). Do you have any links on how to write a custom auth provider?
    – acarlon
    Oct 3, 2021 at 20:57
  • 1
    Here's an old example
    – identigral
    Oct 3, 2021 at 21:01

1 Answer 1


To obtain the ID token from Salesforce SSO when using an identity provider (IDP) like Azure AD, you'll need to follow these steps:

Set up a connected app in Salesforce: a. Go to Setup > App Manager. b. Click on the "New Connected App" button. c. Fill in the required information and make sure to enable OAuth settings. d. Add the desired OAuth scopes (e.g., "Access and manage your data (api)", "Perform requests on your behalf at any time (refresh_token, offline_access)"). e. Save the connected app and note down the Consumer Key (client_id) and Consumer Secret (client_secret).

Configure Azure AD as an IDP in Salesforce: a. Go to Setup > Identity > Identity Provider. b. Follow the steps to configure Azure AD as an IDP (refer to Azure AD documentation for details).

Implement an Apex class to obtain the id_token: a. Create a new Apex class. b. Use the Auth.AuthToken.getAccessToken method to get an access token. c. Send an HTTP request to the Azure AD token endpoint with the required parameters (client_id, client_secret, grant_type, etc.) to get the id_token.

Here's an example Apex class that demonstrates how to obtain the id_token from Azure AD:

public class AzureADTokenHandler {
private static String clientId = 'YOUR_CONSUMER_KEY';
private static String clientSecret = 'YOUR_CONSUMER_SECRET';
private static String tokenEndpoint = 'https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/v2.0/token';

public static String getIdToken() {
    HttpRequest req = new HttpRequest();
    req.setHeader('Content-Type', 'application/x-www-form-urlencoded');

    String body = 'grant_type=client_credentials';
    body += '&client_id=' + EncodingUtil.urlEncode(clientId, 'UTF-8');
    body += '&client_secret=' + EncodingUtil.urlEncode(clientSecret, 'UTF-8');
    body += '&scope=' + EncodingUtil.urlEncode('https://graph.microsoft.com/.default', 'UTF-8');
    body += '&requested_token_use=on_behalf_of';


    Http http = new Http();
    HttpResponse res = http.send(req);

    if (res.getStatusCode() == 200) {
        Map<String, Object> response = (Map<String, Object>) JSON.deserializeUntyped(res.getBody());
        return (String) response.get('id_token');
    } else {
        System.debug('Error getting id_token: ' + res.getStatusCode() + ' ' + res.getStatus());
        return null;

Replace 'YOUR_CONSUMER_KEY', 'YOUR_CONSUMER_SECRET', and 'YOUR_TENANT_ID' with the appropriate values from your connected app and Azure AD tenant.

To obtain the id_token, call the getIdToken() method from your Apex code:

String idToken = AzureADTokenHandler.getIdToken();
System.debug('ID Token: ' + idToken);

Please note that the above code assumes you have already configured Azure AD as an IDP in Salesforce and set up the connected app correctly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .