Questions tagged [single-sign-on]
Single sign-on (SSO) is a property of access control of multiple related, but independent software systems. With this property a user logs in once and gains access to all systems without being prompted to log in again at each of them.
571
questions
1
vote
1
answer
45
views
How to set/choose SSO for user when multiple SSO configurations exist on the org
My goal is to have 2 SSO configurations active on my org. For each internal user I would like to based on criteria or a link direct them to the SSO they should be using. In a way, bind the SSO config ...
- 259
-1
votes
1
answer
45
views
After instance refresh digital experience not working
Our instance got a refresh last night, and now our Experience users cannot login.
We have what appears to be a properly configured SAML configuration.
The authentication provider correctly ...
- 1,645
1
vote
0
answers
42
views
Programmatic selection of SAML config/url upon login
Salesforce allows an org to have multiple SAML configurations under Single Sign on settings. Under My domain one can modify the authentication configuration and select multiple SAML configs under the ...
- 290
0
votes
0
answers
50
views
Two profiles or permission sets and limiting access to one SSO or the other. Possible?
We use Cloud Access Management (CAM) for our SSO. Is it possible to configure two CAM SSO profiles and have that assigned to different sets of users so that User A for instance is given CAM SSO ...
- 290
0
votes
1
answer
120
views
Single Log Out (SLO) error when logging user out of salesforce community
I have single sign on configured where Salesforce is the SP, as shown below in screenshot and we need to use single log out (SLO) to log the community user out of salesforce and IDP as well.
However, ...
0
votes
1
answer
60
views
How can I handle user provisioning with Azure when a user is in multiple groups?
I have a working Azure user provisioning flow. The issue I am facing is if a user is in multiple groups I don't know how to set a priority system. Is there a way I can setup a priority system on Azure ...
- 51
0
votes
0
answers
45
views
Calling APIs via oAuth and fine-grained authorization
I have an external system calling my middleware which then calls Salesforce to retrieve some data. Users login to the external system via an External IDP and retrieve an Access/Refresh Token and an ID ...
- 151
-1
votes
1
answer
76
views
Login with salesforce option on an external website redirecting to salesforce home page after login
We have a single sign on using webauth as identity provider to login to salesforce. Now, I have an external website where they provide a "Sign in with salesforce" option. Whenever I try to ...
- 39
-1
votes
1
answer
264
views
Can we setup salesforce sso or Idp login within Iframe to login to a external site
I have an Iframe in salesforce which loads an external site that supports salesforce sso, currently I'm redirecting the user to the external site auth0 login page and once they login I redirect them ...
- 1
0
votes
0
answers
59
views
SSO into community experience site from a custom third party IdP using JWT Token
I'm trying to setup SSO login for customers into one of our Salesforce digital experience sites. The IdP is a third party custom solution that generates a JWT token. SAML isn't currently an option.
I'...
1
vote
0
answers
68
views
Implementing SAML SSO - Azure and federation id in Salesforce. Need to force sso but only for some users (not admins or integration users)
Implementing SAML SSO - Azure and federation id in Salesforce. Need to force sso but only for some users (not admins or integration users) Can't find how to only have it forced for some.
Found: ...
- 11
1
vote
0
answers
220
views
SAML validation issues
Setting up SSO with Google as an IDP and Salesforce as a service provider.
I see the following when validating SAML:
Current time is after notOnOrAfter in Conditions
Current time is: 2024-01-11T17:...
- 179
-1
votes
1
answer
111
views
SSO - black screen - issue
We are facing strange issue for SSO login. user landing on blank screen(blue color).
This is not happening every time.
if users landing on blue screen, we are deactivating and activating back in IDp ...
- 541
0
votes
0
answers
78
views
How do you do Canvas Authentication in React application?
I am having the nodeJS+React application and now I want to embedded it in Salesforce via Canvas. I have to validate the sign request to find out authenticate users and then need to redirect users to ...
3
votes
2
answers
850
views
How to Authorize VS Code to Dev Org with SSO/Okta
I am looking to authorize my VS Code to an org that utilizes SSO/Okta. How can this be done?
- 91
1
vote
1
answer
172
views
Custom LWC for E-Signature via SSO
I have received a requirement to build a custom LWC used for verifying the users identity which is then embedded in a flow. In case the user can verify his or her identity the flow proceeds.
Now I ...
- 21
0
votes
0
answers
481
views
Using same certificates in production and sandbox for SSO(SAML)
We're using custom domains in sandbox for my communities(2) and performing SSO between them, where one community is acting as an identity provider(IdP) and other as service provider(SP)
To enable SSO ...
- 493
1
vote
1
answer
223
views
SSO using SAML - Error using Heroku App setting Up SAML
I am trying to test out by setting up SSO in my trailhead org. Following these steps - https://help.salesforce.com/s/articleView?id=sf.sso_service_provider_configuration.htm&type=5
I setup SSO ...
- 4,839
0
votes
1
answer
266
views
Can different single sign on be configured for internal org and experience cloud portal?
Can different single sign on authentication providers be configured for internal users and experience cloud portal users?
I assume we can have multiple SAML SSO authentication providers setup but how ...
- 17.5k
0
votes
0
answers
249
views
SSO and CA-signed certificates
We are trying to set up SSO with Okta for our prod salesforce instance.
And one of the compliance requirements from our IT/security department is to use only CA-signed certificates, i.e. self-signed ...
- 3,140
0
votes
0
answers
41
views
Salesforce MobileSDK app login via SAML SSO still required to perform Salesforce MFA
My org has an SAML 2.0 Single Sign-On enabled with:
Azure AD:
SAML Identity Type: Federation ID
SAML Identity Location: Subject
Service Provider Initiated Request Binding: HTTP Redirect
Use ...
0
votes
0
answers
265
views
Sending a multi-valued attribute in SAML assertion
I made connected App in Sandbox to log in AWS using SSO from Salesforce
(SFDC-identity Provider, AWS - ServiceProvider)
we set up NAME ID Format (urn:oasis:names:tc:SAML:2.0:nameid-format:persistent) ...
- 1
0
votes
0
answers
111
views
SSO without SAML or OpenID Connect
What are the other options can we use for SSO with Salesforce as the identity provider if the other party does not support SAML or OpenID Connect?
Is it necessary to use a Custom Bridge that can ...
0
votes
0
answers
147
views
Community - Allowing Direct Login but Preferring SSO
My Community uses a homegrown system as its IdP. The identity portion runs on Okta. When the user clicks a link in the homegrown system, they are brought to the Community and logged in using SSO.
We ...
- 508
0
votes
0
answers
150
views
SSO between Experience Cloud and external E-commerce site
The client needs Is the following:
From the e-commerce (external hosted) when they want to register,they are redirected to the salesforce community Page where they can log-in or register. After they ...
0
votes
0
answers
91
views
Log in and Sign Up to a Salesforce Community from an External System
I have a scenario where the customer can sign up/login from an external ecommerce system to a salesforce community with SSO and land on the community.
How can i achieve this? Salesforce as Identity ...
0
votes
0
answers
165
views
Single Logout (SLO) via OpenID Connect
We use an external identity provider to verify credentials with SSO via OpenID Connect to Salesforce Experience Cloud as the Relying Party. After the the person logs out from Site A, he should be ...
- 27
-3
votes
1
answer
73
views
Login to Salesforce from .NET [closed]
I tried to login to as salesforce community user from a .NET application "https://perfectvisionpoe--pvccdevorg.sandbox.my.salesforce.com/services/Soap/c/55.0/_____" API callout but I am able ...
- 3,879
0
votes
0
answers
243
views
How to get the service provider Id from a connected app of SSO
We have service provider id in Salesforce which looks something like this - '0sp3I0000004CN4'
This is used in the IdP-Initiated Login URL.
Here is the documentation for that: IdP-Initiated Login URL
...
- 166
1
vote
1
answer
1k
views
SSO with Communities: Invalid portal id
I am implementing single sign on with my customer, salesforce acting as service provider.
We already tested the single sign on and it works for us with the Salesforce organization. We can log into the ...
- 96
0
votes
0
answers
1k
views
"The Single Sign-On Gateway Url is invalid" error when making API calls
I'm testing API calls to Salesforce via Connected Apps in an environment where SSO is enforced via Permission sets. For the SSO I'm federating using Facebook.
The communication works fine without SSO (...
- 1
0
votes
1
answer
201
views
Problem with Salesforce as Service Provider (SP) and other system as Identity Provider (.PEM certificate)
I am trying to implement single sign on (SSO) with my client, using SAML 2.0.
My client has an application in "Outsystems", "Outsystems" will act as Identity Provider (IdP) and ...
- 96
0
votes
1
answer
2k
views
Populating a Federation ID when implementing SSO
We are about to implement SSO, with Azure being the Identity Provider.
If we use Federation ID to be the unique identifier for SSO how will we populate the Federation ID field in Salesforce ? Is it up ...
- 3,904
2
votes
1
answer
956
views
Why doesn't SSO between my Digital Experience sites work?
The steps here Configure SAML SSO Between Salesforce Orgs or Experience Cloud Sites are detailed and clear. But having gone through those, I'm still seeing the the separate logins rather than the ...
- 137k
0
votes
0
answers
250
views
How to launch IDP-initiated SSO for a SAML-enabled Connected App?
I have a SAML-enabled connected app configured for a 3rd party service provider to be used by community users (SF is IdP).
However, I can't expose SF's native app launcher as this community is under ...
- 2,634
3
votes
0
answers
139
views
Is single sign-on for self-registering Digital Experience users possible?
We have a Digital Experience that includes self-registration logic that, when completed correctly, goes ahead and creates the necessary Contact and User resulting in the welcome email being sent. The ...
- 137k
-1
votes
1
answer
300
views
SSO login to shared account
sso enabled in org and everything works fine. we have new requirement like 2 different users want to login with same account I mean user x and user y wants to login salesforce with same user called xy ...
- 541
0
votes
0
answers
28
views
Help with SamlJit Handler regarding querying total number of profile license
We activated SSO in Salesforce and Azure, the users that will login to the community portal should have the license Salesforce Platform.
How can I query this profile license in the SamlJit Handler and ...
- 1
0
votes
0
answers
336
views
How to obtain access token after SSO when Salesforce is a service provider?
Our users log into Salesforce using the Single Sign-On provided by our Employer. Here Salesforce is a service prover and the Employer's system is the identity provider. The SSO is configured based on ...
- 463
3
votes
1
answer
7k
views
Will "Disable login with Salesforce credentials" lock-out Administrators as well?
We have Okta setup as a SSO provider for Salesforce. We want to restrict all non-Administrators from logging in with their Salesforce Username and Password. However, we still want Administrators to be ...
- 5,079
-1
votes
1
answer
2k
views
Cannot login to new Sandbox
We have a new Salesforce org. SSO enabled for user login in Production.
I created a new sandbox (Developer Pro) from Production.
After Sandbox was created, I got an email Sandbox: xxx is ready to use
...
- 865
-1
votes
1
answer
393
views
MFA and SSO issue
we have had SSO setup for Salesforce a while now and recently had to setup MFA as it was being auto enabled by Salesforce, but now the users are asked to download the authenticator app, Is there ...
- 1
0
votes
0
answers
664
views
Is there a simple way to test a SAML JIT handler class?
I'm in the process of configuring Single Sign-On for my org and this org will require JIT user provisioning. I've written a custom SAML JIT handler class to handle that logic and now I want to test ...
- 165
1
vote
0
answers
405
views
Passing information from custom SAML JIT handler to error URL
Using SSO in SF, there is an option to insert Apex in the SAML JIT Handler.
For each scenario, failure or success, there are fields intended for redirecting the user automatically (Custom Logout URL, ...
- 1,199
1
vote
1
answer
2k
views
SAML - difference between Identity Type and Identity Location
I am implementing Salesforce as a service provider and I am expected to provide some general guidelines to the application which will be set as the identity provider.
There is documentation explaining ...
- 903
1
vote
1
answer
474
views
Auth Provider with a Google account: redirect the user after they log in [duplicate]
I have setup SSO for an experience cloud site, I selected Google for the SSO and did not specify the authentication URLs and consumer key/secret.
The SSO works fine, what I want to do is redirect the ...
- 11
0
votes
1
answer
436
views
Is Salesforce supporting JIT (just in time provisionning) over OpenID
We want to use OpenId SSO for our Salesforce Community Users provisionning
and I was wondering if Salesforce supports JIT (just in time provisionning) over OpenID (contact + account + user creation ...
- 15
1
vote
0
answers
67
views
Org-to-org: certificate-based authentication when calling REST APIs
I have implemented SSO among two ORGS. I have made a web services class in my service Org. Can I hit that web service from my Identity provider Org using rest callout? I tried it by making a http get ...
0
votes
0
answers
303
views
Users without 'Is Single Sign-On Enabled' checked flag are still able to log in via SSO
After thorough checking of users, I noticed that some of them, despite having no profile or permission set assigned with 'Is Single-Sign-On' flag enabled, are able to log in via SSO. What can be the ...
- 452
1
vote
1
answer
488
views
Google Workspace SSO-enabled Org Cross-Domain Cookies Error
My Salesforce org has SSO implemented using SAML 2.0 with Google Accounts / Workspace as the Identity Provider (IdP).
Everything worked well, until I recently decided to move from Chrome to Brave as ...
- 121