# Single sign-on for sites: SAML and authentication providers

*Experience Cloud Consultant Study Guide · User Creation and Authentication · Last updated October 24, 2026 · https://www.certifyforce.com/study-guide/experience-cloud-consultant/user-creation-and-authentication/single-sign-on-for-sites-saml-and-authentication-providers*

The SSO options for Experience Cloud sites and when each fits: the site as a SAML service provider (with the site login URL), as a relying party through predefined or OpenID Connect authentication providers with a registration handler and the site URL parameter, as an identity provider for an outside app, and SSO for mobile apps with OAuth.

- Certification: Salesforce Experience Cloud Consultant
- Exam section: User Creation and Authentication
- Study guide: https://www.certifyforce.com/study-guide/experience-cloud-consultant

**Official exam objective:**

> Describe options for Single Sign-On.

## What the exam expects

- Choose the SSO pattern from the direction of trust: site as SAML service provider, site as relying party with an authentication provider, site as identity provider, or SSO for mobile apps.
- Tell when SAML (authentication only) is enough and when an authentication provider fits (authentication plus access to third-party data).
- Extend an org's SAML SSO to a site so users land on the site, not the internal login.
- Put an authentication provider button on a site login page and send users to the site after login.
- Explain what a registration handler does.

Key terms: **service provider / relying party** (the site trusts a third party to authenticate its users); **identity provider** (the site authenticates users for another app); **authentication provider** (Salesforce's framework for predefined providers such as Google and OpenID Connect providers); **registration handler** (Flow or Apex that creates or updates the Salesforce user after the provider authenticates them); **Single Sign-On Initialization URL** (the provider URL that starts SSO, where the site parameter is added).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Authentication only from a SAML IdP | Site as SAML service provider | [Service Provider or Relying Party](https://help.salesforce.com/s/articleView?id=external_identity_sso_sp.htm&type=5&language=en_US) |
| Third party also authorizes data access | Authentication provider, site as relying party | [Service Provider or Relying Party](https://help.salesforce.com/s/articleView?id=external_identity_sso_sp.htm&type=5&language=en_US) |
| Extending org SAML to a site | Use the site login URL; the assertion POST includes /login | [SAML for Experience Cloud Sites](https://help.salesforce.com/s/articleView?id=networks_auth_configure_saml.htm&language=en_US&type=5) |
| Site Login URL format | `https://domainName/login?so=orgID` | [JIT Assertion Fields for Experience Cloud](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_community_requirements.htm&language=en_US&type=5) |
| Provider button | Login & Registration > Login Page Setup | [Add an Authentication Provider to the Login Page](https://help.salesforce.com/s/articleView?id=sf.sso_provider_customer_add_login_option.htm&language=en_US&type=5) |
| Registration handler | Flow or Apex; creates or updates the user | [Create an Authentication Provider Registration Handler](https://help.salesforce.com/s/articleView?id=xcloud.sso_create_registration_handler.htm&language=en_US&type=5) |
| Site parameter | On the Single Sign-On Initialization URL, sends users to the site | [Direct Users to a Site after Authentication](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_addl_params_community.htm&language=en_US&type=5) |
| Site credentials for an outside app | Site as SAML identity provider or OpenID provider | [Identity Provider or OpenID Provider](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_sso_idp.htm&language=en_US&type=5) |
| Mobile SDK app | SSO for mobile apps with OAuth | [Single Sign-On for Salesforce Customer Identity](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.external_identity_single_sign_on_use_cases.htm&type=5) |

## Check yourself

- Why would a consultant pick a SAML service provider setup over an authentication provider?
- When does the site act as an identity provider?
- What must the SAML assertion POST to a site include?
- Which predefined authentication providers does Help name for site sign-in?

## Sources

- [Single Sign-On for Salesforce Customer Identity](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.external_identity_single_sign_on_use_cases.htm&type=5)
- [Configure Your Experience Cloud Site as a Service Provider or Relying Party](https://help.salesforce.com/s/articleView?id=external_identity_sso_sp.htm&type=5&language=en_US)
- [SAML for Experience Cloud Sites](https://help.salesforce.com/s/articleView?id=networks_auth_configure_saml.htm&language=en_US&type=5)
- [Configure SSO with Salesforce as a SAML Service Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml.htm&language=en_US&type=5)
- [Just-in-Time SAML Assertion Fields for Experience Cloud](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_community_requirements.htm&language=en_US&type=5)
- [Enable Just-in-Time Provisioning](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_enable_jit.htm&language=en_US&type=5)
- [Add an Authentication Provider to Your Experience Cloud Site's Login Page](https://help.salesforce.com/s/articleView?id=sf.sso_provider_customer_add_login_option.htm&language=en_US&type=5)
- [Create an Authentication Provider Registration Handler](https://help.salesforce.com/s/articleView?id=xcloud.sso_create_registration_handler.htm&language=en_US&type=5)
- [Direct Users to an Experience Cloud Site after Authentication](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_addl_params_community.htm&language=en_US&type=5)
- [Configure Your Experience Cloud Site as an Identity Provider or OpenID Provider](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_sso_idp.htm&language=en_US&type=5)
- [Set Up SSO for Mobile Apps](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_sso_mobile.htm&language=en_US&type=5)
- [Login Page Types](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_discovery_login_types.htm&language=en_US&type=5)
- [RegistrationHandler Interface](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_auth_plugin.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 7 linked practice questions, and unlimited timed mock exams are included with the Experience Cloud Consultant pack (USD $19): https://www.certifyforce.com/practice-exams