I'm reading about Salesforce SSO, I have some questions/clarification,

  1. I find the concept of Delegated Auth, SP Initiated Login to be same since salesforce calls the external IDP or external service to verify user by posting tokens/certs. If so for SSO we need IDP server like Active Directory, for Delegated Auth we just need a web service or custom app for salesforce to post. Is this correct?

  2. For SP initiated session, we are only configuring certification from IDP, at the time of login, if the user is not logged in IDP he needs to login to IDP first ? since the user name is not know by salesforce until IDP authenticates the users and returns assertion with user info, but salesforce only posts saml request?

  3. PKI question - Idp possess private key, SP possess public key?


1 Answer 1


Delegated Authentication is specific to Salesforce only (not industry standard) where external Webservice only returns True and False saying Authentication is complete or not.

However, in SP initiated SSO, IDP may use SAML protocol. Sometime back I had written blog post and Video tutorial on SAML, you may like to check this - http://www.jitendrazaa.com/blog/salesforce/step-by-step-guide-to-setup-federated-authentication-saml-based-sso-in-salesforce/

Also, there is very good answer by Pat on same line here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .