I am new to Single Sign on configuration on Salesforce and have a use case which I was hoping the community can advise upon.

We have a web app outside of Salesforce. We are currently in the process of initiating the web app flow from the Opportunity on Salesforce. The flow is as follows.

A Salesforce User creates an Opportunity. On the opportunity layout, there is a button (lets say "Invoke Web app"). When the SF user clicks the button, our external webapp should open in a separate tab.

However, we are aiming for two things

  1. When the button is clicked, SF, acting as an identity provider, should initiate the Identity Provider SSO flow as described here (https://help.salesforce.com/s/articleView?id=sf.identity_provider_about.htm&type=5). When the user logs in, we will create a corresponding user in our web app. This will need a Connected App in the Salesforce Org for Service Provider Configuration.

  2. The SF user then creates a discovery record in our web app which we want to write back into Salesforce. We are assuming this will need another Connected App with OAuth settings.

  3. Once the record is created in SF, any changes by a SF user in Salesforce should then be reflected in our external web app as well. A REST API to sync changes. I am not sure what Authorisation to implement at this point. Our webapp does support Oauth but I am struggling to understand at what point should we invoke this (immediately after SSO is finished in Step 1???)

The question I am struggling to answer is in our Flow the SSO creates a user in our web app . Does SSO grant some authorisation token which can be used in a subsequent REST API call?

1 Answer 1


For the second use case, you wont need another connected app in this case. You can use the same connected app you used in the SSO to request for an OAuth token.

Checkout the OAuth 2.0 SAML Bearer Assertion Flow for Previously Authorized Apps flow. This allows you to use SAML assertions to request an OAuth token directly.

For the third scenario, You can use the Change Data Capture or platform events and implement an event handling stream in your system.

Or another suboptimal way is to use a simple trigger in Salesforce and perform a queueable callout that invokes APIs of your system.

  • Thanks @Mohith . Just so that I have understood this correctly, the SSO connected app can also be used to get an OAUTH API token if our webapp calls the token endpoint and passes the SAML assertion, right? Apr 11, 2022 at 8:41
  • Correct!! Yes that's right Apr 11, 2022 at 13:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .