My Community uses a homegrown system as its IdP. The identity portion runs on Okta. When the user clicks a link in the homegrown system, they are brought to the Community and logged in using SSO.

We now have a population of users who are not present in the IdP who need to access the Community. For these users, we want them to access the Community using a direct login on its own URL. But, at the same time, we want users coming in through SSO to be put straight through.

Speaking with Salesforce Support, they are telling me that this scenario is impossible, and that when I allow a login method other than SSO in the Experience Administration -> Login & Registration:

Login & Registration Page Screenshot

I've tried modifying a login page with an LWC to identify the user, but all users coming in from the IdP show as guest users -- in other words the login page happens before the SSO is initiated.

I feel like there has to be a way to do this. For internal users, we have this exact scenario set up so that all users are forced through Okta while certain people can login directly in case Okta goes down. It's as simple as the "Is Single Sign-On Enabled" in a Profile/Permission Set.

Thank you in advance!

  • It's possible in some cases, the devil is in the details. With a homegrown IdP, this isn't a good question for this forum.
    – identigral
    Sep 25 at 21:57
  • Thank you, I should clarify, it's a homegrown system/appl but the IdP part is Okta based. Sep 25 at 22:07
  • Out of the box, if you configure an external IdP, it'll show up as a button on your login screen. The URL associated with this button can be used for direct sign-on. The regular username/pwd route is still available. This trailhead walks through this for internal users: trailhead.salesforce.com/content/learn/modules/identity_login . For external, there are more variables in play but same principles apply.
    – identigral
    Sep 25 at 22:59
  • We do have this set up for internal users, but it seems Communities behave differently. The current behavior is that when the user clicks from the IdP into the Community, it goes straight in. I have not been able to find a way for users coming in that way to be sent to the Community directly, while also allowing a username and password. Any method -- login, discovery login, custom handlers, that requires user input stops the SSO in its tracks. Sep 26 at 0:19
  • It's not the Community, it's your customizations. They can work with SSO the way you want but again, the devil is in the details. Your best bet is to find a consultant to help you with this.
    – identigral
    Sep 26 at 1:09


You must log in to answer this question.

Browse other questions tagged .