0

currently we have ADFS SSO setup in our org and I would like prevent our users to login to Salesforce using the general login.salesforce.com link but we do not want to check the "Prevent login from https://login.salesforce.com" because if our ADFS goes down even us (Admin) unable to login. So we just want our users to use the mydomain url to login as SSO but not Admin and I found it can be done by setting up delegated authentication.

So will this still work with ADFS SSO? What will be the sequence? If i have this delegated authentication setup, the user tried to login through https://login.salesforce.com and our webservice will simply return false? So they will need to use mydomain url? If they use mydomain url to login then it will bypass delegated authentication?

Thanks

Improve this question
0

Delegated authentication is very rarely the right thing to do. I suggest you enable MyDomain, so that the login page for your org is unique, and then leave the SSO off for system administrators, so that they can still login in case your ADFS is down.

I hope it helps.

Improve this answer
1
  • Hi Lorenzo, I have already enable MyDomain and using ADFS now. How can i prevent all my users (except admin) doesn't login through general login.salesforce.com but via MyDomain url?
    – user2074703
    Nov 20 '15 at 0:36
0

@user2074703 You can leverage frontdoor to accomplish what you want. By clicking "Prevent login from https://login.salesforce.com", this does not prevent admins obtaining a Salesforce Session Id via an API call such as SOAP API login(). From there you can use the SessionId to go through the frontdoor to login if your ADFS IdP is down.

Improve this answer
-1

Yes, it is a recommended practice... Please read the link below. https://help.salesforce.com/articleView?id=000329322&type=1&mode=1

Improve this answer
2
  • 3
    Welcome to Salesforce SE! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.
    – identigral
    Oct 6 '19 at 14:29
  • As mentioned by others, please cite any relevant content from the link within your post (which you can edit). Also, please do not ask for votes in your posts.
    – Adrian Larson ♦
    Oct 7 '19 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.