I'm struggling to understand basic Single Sign-On concepts and how to design a Salesforce implementation.
I want Salesforce to be the "master" user directory among various "child" external apps. That means Salesforce is the SSO identity provider, and the child apps are the service providers, correct?
Is it sufficient to enable the identity provider feature in Setup, or do I need the Identity Connect product as well?
If I create a customer portal or community user in Salesforce, will that user account be automatically created in all the service provider apps? Can I limit the auto creation to certain types or profiles of portal/community users?
If the user is not auto created and I have to create manually in the service provider apps, how does SSO know that the manually created users are related to the Salesforce user?
The example in Help mentions populating the Federation ID field in the Salesforce user record with the Google apps user. I don't understand that - how can you have multiple service provider apps linked to the Salesforce user if there is only one Federation ID? http://help.salesforce.com/HTViewHelpDoc?id=identity_provider_examples.htm&language=en_US#sp_google_example_enabling_user