We want an external app to login into salesforce with user credetials and then call our restApi in our custom code. The authorization should work via saml sso.

User in the external app starts the process -> Salesforce login screen -> Logs in with user credentials -> after log in the external app calls the restApi.

I used this documentation https://help.salesforce.com/s/articleView?id=sf.sso_between_multiple_orgs.htm&type=5&language=en_US and tried to stick as close as possbile. But I use the username as the subjectType instead of a federation id.

As far as I understood, for this usedcase, salesforce is my identity and service provider. Anf if it works correctly i should be able to log in and then, call the rest service, but I always get an INVALID_SESSION_ID error as a result.

  1. Is my approach even right?
  2. If my appraoch is right, are there more steps necessary exept those in the documentation I used?
  3. To login I use the ACS URL of my connecte app, which is the login url of my SSO setting. is this correct?

Additonal information: 2 Weeks ago I had a kinda working state where I logged in and used my sessionId as a bearer token in postman and I got the expected result. So I guess my approach is right, but I don't know what changed since then.

  • 1
    You want oAuth authorization code grant (aka Web Server flow in Salesforce). While SAML can be used for authorization, that would be an exotic scenario and implementing it would be challenging.
    – identigral
    Sep 4, 2022 at 15:31
  • 1
    The saml sso was a proposal from someone else, but when I read the doc I already thoght it does not fit. I use a oAuth authorization code now and it works like a charm, thank you.
    – N4go
    Sep 12, 2022 at 8:57

1 Answer 1


Like recommended I used oAuth instead and it works right away

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .