We have a heroku-hosted web app that used Salesforce as Identity Provider (IdP) to do Single Sign-On (SSO) between SFDC & other services. We know that in doing so our web app user are already logged into their SFDC account. Then what is the best way for our web app to obtain SFDC REST API access under user's SFDC account without asking for a password or redirecting?

We have basic understanding on OAuth, SAML and SSO. Also we have studied the following pages:

  1. https://help.salesforce.com/HTViewHelpDoc?id=remoteaccess_authenticate.htm&language=en_US
  2. https://developer.salesforce.com/page/Single_Sign-On_for_Desktop_and_Mobile_Applications_using_SAML_and_OAuth
  • Is the Heroku web app a Service Provider? Does it have access to the SAML Assertion from Salesforce?
    – metadaddy
    Sep 10, 2014 at 20:52
  • Yes I think our Heroku app will be the SP and it has ability to access SAML Assertion.
    – Oscar Tang
    Sep 11, 2014 at 3:09

1 Answer 1


You can pass a session ID as an attribute in the SAML Assertion. In the Connected App configuration for your SP, set $Api.Session_ID as a Custom Attribute value. The recipient will be able to use the session ID with the REST API.

  • Once again thank you for your reply. I have tried your solution. It works when I login as internal user with internal login portal. However it does not work when I login as an external user (community user) using community login portal. It gives the following error message when I use the session id to make REST API call: [ { "message" : "This session is not valid for use with the REST API", "errorCode" : "INVALID_SESSION_ID" } ] Any ideas?
    – Oscar Tang
    Sep 12, 2014 at 9:49
  • Looks like communities users are locked down differently to standard. Investigating whether there's a way to do this...
    – metadaddy
    Sep 12, 2014 at 23:15
  • @metadaddy Are you able to investigate the root cause, we are also facing the same issue
    – Lohith MV
    Jan 10, 2018 at 9:30
  • @LohithMV No - I'm no longer at Salesforce. I suggest you contact Salesforce support.
    – metadaddy
    Jan 11, 2018 at 6:02
  • @OscarTang were you able figure out the fix for this? even we have the same issue.
    – Sachin
    May 21, 2020 at 13:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .