I've gotten a requirement to build a login mechanism for my web and mobile apps that allows users who are members of a salesforce.com community site to leverage their SFDC logins to access my application.

Two questions: 1) Is there any special about an SFDC communities user account that makes it different from a standard SFDC account? My understanding is when setting up a community site, you have to create the site and assign specific profiles that can access it, and communities just leverages the main SFDC user list to determine who can access that community site based off your selected profiles.

2) Is this technically feasible to do, and how? My initial thought here is to create a connected app in SFDC and use the user agent (implicit) or authorization grant flow, That might work fine for web, but on mobile, I can't really be storing a client ID or login url, which is where I'm stuck. Is there a better way to do this?

1 Answer 1


I think the important question for you to learn is going to be: Is the community already set up to use OAuth for users logging into the community? To me, that would seem to an essential part of the equation. Salesforce can act as the Authentication point once they're logged in, but to do so, based on the reading I've done, it would seem to require that OAuth be enabled for users logging into the Community.

To answer Question 1, Community Users are no different than other users in that they're simply Salesforce Users who use a particular license associated with their profile. They are indeed Users with passwords and not "Contacts".

As for Question 2, again I think the issue is that the Community will likely need to have OAuth enabled as an option for Users to use when logging in. I know that Salesforce can act as the Authentication Service, just like Google, Facebook, etc. Ultimately though, I think you want to avoid having their servers be the primary authentication source if at all possible, but instead use Salesforce to confirm their OAuth credentials (I think that's the proper term/phrasing).

For detailed information on this subject, I recommend you look at the following documents (some will be repetitive/overlapping): Identity Implementation Guide, Security Implementation Guide and Single Sign-On Implementation Guide.

  • Thank you, this makes sense. I have never seen the identity implementation guide so that will be a good read-through for me.
    – nurath
    Oct 12, 2015 at 13:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .