Single sign-on (SSO) is a property of access control of multiple related, but independent software systems. With this property a user logs in once and gains access to all systems without being prompted to log in again at each of them.
Single sign-on is a process that allows network users to access all authorized network resources without having to log in separately to each resource. Single sign-on allows you to validate usernames and passwords against your corporate user database or other client application rather than having separate user passwords managed by Salesforce.
Salesforce offers the following ways to use single sign-on:
- Federated authentication using Security Assertion Markup Language (SAML): When federated authentication is enabled, Salesforce does not validate a user’s password. Instead, Salesforce verifies an assertion in the HTTP POST request, and allows single sign-on if the assertion is true. This is the default form of single sign-on. Federated authentication is available in all Editions.
- Delegated authentication: When delegated authentication is enabled, Salesforce does not validate a user’s password. Instead, Salesforce makes a Web services call to your organization to establish authentication credentials for the user. You must request that this feature be enabled by salesforce.com.
- Authentication providers: When authentication providers are enabled, Salesforce does not validate a user’s password. Instead, Salesforce uses the user’s login credentials from an external service provider to establish authentication credentials.