Security Assertion Markup Language
Enterprise-grade single sign-on using SAML 2.0 assertions for federated authentication
User accesses Salesforce, redirected to IdP for authentication
User authenticates with identity provider
IdP sends signed SAML assertion to Salesforce
Salesforce validates assertion and grants access
metadata
https://mycompany.my.alesforce.com/services/auth/idp/metadata
<!-- SAML Response Example -->
<Response>
<Assertion>
<Attribute Name="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">
user@company.com
</Attribute>
<Attribute Name="User.FirstName">
John
</Attribute>
<Attribute Name="User.LastName">
Doe
</Attribute>
</Assertion>
</Response>
OAuth 2.0 Extension
Modern identity layer on top of OAuth 2.0 providing user authentication and profile information
Client redirects user to OpenID Provider
User authenticates with OpenID Provider
Exchange code for ID token and access token
Salesforce validates assertion and grants access
// OpenID Connect Flow
const authUrl = `https://login.salesforce.com/services/oauth2/authorize?` +
`response_type=code&` +
`client_id=${clientId}&` +
`redirect_uri=${encodeURIComponent(redirectUri)}&` +
`scope=openid profile email&` +
`nonce=${nonce}`;
// Token exchange
const response = await fetch('https://login.salesforce.com/services/oauth2/token', {
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded'
},
body: new URLSearchParams({
grant_type: 'authorization_code',
code: authorizationCode,
client_id: clientId,
client_secret: clientSecret,
redirect_uri: redirectUri
})
});
// Decode JWT ID token
const tokenData = await response.json();
const idTokenPayload = JSON.parse(atob(tokenData.id_token.split('.')[1]));
Custom Authentication Handler
Custom authentication against external systems while maintaining Salesforce session management
User attempts to log into Salesforce
Salesforce calls custom authentication handler
Handler validates credentials against external system
Salesforce processes handler response and grants access
// Delegated Authentication Handler (Apex)
global class CustomAuthHandler implements Auth.AuthProviderPlugin {
global String getCustomMetadataType() {
return 'CustomAuth__mdt';
}
global PageReference initiate(Map authProviderConfiguration,
String stateToPropagate) {
// Redirect to external auth system
String authUrl = authProviderConfiguration.get('Auth_Url__c');
PageReference pageRef = new PageReference(authUrl);
return pageRef;
}
global Auth.AuthProviderTokenResponse handleCallback(
Map authProviderConfiguration,
Auth.AuthProviderCallbackState state) {
// Process callback from external system
String accessToken = state.queryParameters.get('access_token');
return new Auth.AuthProviderTokenResponse(
'CustomAuth', accessToken, null, state.stateToPropagate);
}
}
Choose the right SSO flow based on your organization requirements
Yes: SAML SSO (most common enterprise choice)
No: Consider OpenID Connect for modern applications
Yes: Do you need modern web/mobile application support?
No: SAML SSO for traditional enterprise applications