# Authentication providers for OpenID Connect and social sign-on

*Platform Identity and Access Management Architect Study Guide · Accepting Third-Party Identity in Salesforce · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/accepting-third-party-identity-in-salesforce/authentication-providers-for-openid-connect-and-social-sign-on*

How to choose between a SAML setting, a predefined or OpenID Connect authentication provider, a custom Apex provider and delegated authentication when Salesforce accepts a third party's identity, and how to configure providers: registration handler, Salesforce-managed sandbox apps, PKCE, single logout, the client configuration URLs and their request parameters, and third-party access tokens.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Accepting Third-Party Identity in Salesforce
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a scenario, recommend the authentication mechanism when Salesforce needs to accept 3rd Party Identity.

## What the exam expects

- Recommend the mechanism for accepting a third party's identity: a SAML single sign-on setting, a predefined authentication provider, an OpenID Connect provider, a custom Apex provider, or delegated authentication.
- Know which predefined provider types support single sign-on and which only give third-party data access.
- Configure an authentication provider: app registration, Consumer Key and Secret, endpoints, registration handler, PKCE, Custom Logout URL, and the login page.
- Use Salesforce-managed apps for sandbox prototypes and your own apps for production.
- Pick the right client configuration URL and request parameter (site, prompt) for a requirement, and use the third party's access token.

Key terms: **authentication provider** (Salesforce's record of a third party that logs users in through OAuth 2.0 or OpenID Connect); **relying party** (the system that trusts the provider's login, here Salesforce); **registration handler** (the Apex class or flow that matches, creates or updates the Salesforce user); **client configuration URLs** (the generated Test-Only, Single Sign-On, Existing User Linking, OAuth-Only and Callback URLs).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| No SSO | GitHub and Microsoft Access Control Service: data access only; X: SSO but no data access | [Define an Authentication Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_predefined_authentication_provider_parent.htm&language=en_US&type=5) |
| OAuth 2.0 without OpenID Connect | Custom provider: custom metadata type plus `Auth.AuthProviderPluginClass` | [Custom External Authentication Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_plugin_custom.htm&language=en_US&type=5) |
| Registration handler | Required for SSO; Apex or Flow | [Registration Handler](https://help.salesforce.com/s/articleView?id=xcloud.sso_create_registration_handler.htm&language=en_US&type=5) |
| Salesforce-managed apps | Leave key, secret, endpoints and scopes blank; sandbox only | [Salesforce-Managed Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_global_auth.htm&language=en_US&type=5) |
| PKCE | Use Proof Key for Code Exchange (PKCE) Extension checkbox | [OpenID Connect Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_openid_connect.htm&language=en_US&type=5) |
| OAuth-Only Initialization URL | Third-party data access, no SSO | [Add Functionality](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_addl_params.htm&language=en_US&type=5) |
| prompt values | `login` re-authenticates, `consent` re-authorizes | [Prompt Users](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_addl_params_prompt.htm&language=en_US&type=5) |
| Site parameter | Sends users to the site; can change the user type created | [Direct Users to a Site](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_addl_params_community.htm&language=en_US&type=5) |
| OIDC SLO endpoint | `/services/auth/idp/oidc/logout` on My Domain; front-channel only | [OpenID Connect SLO](https://help.salesforce.com/s/articleView?id=xcloud.security_auth_slo_oidc_rp_configuring.htm&language=en_US&type=5) |

## Check yourself

- Why is a custom Apex provider unnecessary for a third party that implements OpenID Connect?
- When should a site start a connection with the OAuth-Only Initialization URL?
- When can an admin leave Consumer Key and Consumer Secret blank on a Google provider?
- Which provider type lets employees log in with Microsoft Entra ID work accounts?

## Sources

- [Authentication Provider SSO](https://help.salesforce.com/s/articleView?id=xcloud.sso_authentication_providers.htm&language=en_US&type=5)
- [Define an Authentication Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_predefined_authentication_provider_parent.htm&language=en_US&type=5)
- [Configure an Authentication Provider Using OpenID Connect](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_openid_connect.htm&language=en_US&type=5)
- [Create a Custom External Authentication Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_plugin_custom.htm&language=en_US&type=5)
- [Configure a Salesforce-Managed Authentication Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_global_auth.htm&language=en_US&type=5)
- [Add Functionality to an Authentication Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_addl_params.htm&language=en_US&type=5)
- [Direct Users to an Experience Cloud Site after Authentication](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_addl_params_community.htm&language=en_US&type=5)
- [Prompt Users to Reauthenticate and Reauthorize](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_addl_params_prompt.htm&language=en_US&type=5)
- [Configure OpenID Connect Single Logout with Salesforce as the Relying Party](https://help.salesforce.com/s/articleView?id=xcloud.security_auth_slo_oidc_rp_configuring.htm&language=en_US&type=5)
- [Create an Authentication Provider Registration Handler](https://help.salesforce.com/s/articleView?id=xcloud.sso_create_registration_handler.htm&language=en_US&type=5)
- [Configure a Microsoft Authentication Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_microsoft_only.htm&language=en_US&type=5)
- [Configure a Salesforce Authentication Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_sfdc.htm&language=en_US&type=5)
- [Add an Authentication Provider to Your Org's Login Page](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_org_login_page.htm&language=en_US&type=5)
- [Add an Authentication Provider to Your Experience Cloud Site's Login Page](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_customer_add_login_option.htm&language=en_US&type=5)
- [Delegated Authentication](https://help.salesforce.com/s/articleView?id=xcloud.sso_delauthentication.htm&language=en_US&type=5)
- [Just-in-Time Provisioning for SAML](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_about.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 17 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams