# Establishing trust with certificates, metadata and signed tokens

*Platform Identity and Access Management Architect Study Guide · Identity Management Concepts · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/identity-management-concepts/establishing-trust-with-certificates-metadata-and-signed-tokens*

Which certificate goes where when Salesforce is a SAML service provider or identity provider, how Issuer, Entity ID and metadata set up trust, and how JWT bearer signatures, mutual TLS, named and external credentials and the delegated authentication endpoint establish trust between systems.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Identity Management Concepts
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Describe how trust is established between two systems.

## What the exam expects

- Say which party's certificate goes in which SAML field when Salesforce is the service provider and when it is the identity provider, for signing and for encryption.
- Explain how Issuer and Entity ID tie an assertion to its sender and recipient, and use metadata files or URLs to set up trust in both directions.
- Plan for certificate rotation so partners don't lose SSO.
- Describe how the JWT bearer flow and mutual TLS let servers prove their identity, and how named and external credentials hold trust for outbound callouts.
- List what a delegated authentication endpoint needs for Salesforce to reach and trust it.

Key terms: **signing certificate** (public half of the key pair that signs a message; the other side validates with it); **Issuer / Entity ID** (identifiers of the sender and the intended audience); **metadata** (XML file describing a SAML configuration); **JWT bearer flow** (a server signs a JWT to get an access token); **mutual TLS** (both sides present certificates during the TLS handshake); **external credential** (the authentication protocol and principals behind a named credential).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Issuer field | Must match `<saml:Issuer>` in the assertion | [Create a SAML SSO Setting](https://help.salesforce.com/s/articleView?id=xcloud.sso_service_provider_configuration.htm&language=en_US&type=5) |
| Entity ID field | Must match one `<saml:Audience>` value | [Create a SAML SSO Setting](https://help.salesforce.com/s/articleView?id=xcloud.sso_service_provider_configuration.htm&language=en_US&type=5) |
| Salesforce IdP default certificate | Self-signed, SHA-256 | [Enable Salesforce as a SAML IdP](https://help.salesforce.com/s/articleView?id=sf.identity_provider_enable.htm&language=en_US&type=5) |
| Verify Request Signatures | Once a certificate is uploaded, all SAML requests must be signed | [SAML-Enabled Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_saml_sso.htm&language=en_US&type=5) |
| Encrypt SAML Response | Service provider's certificate; AES-128 or AES-256 | [SAML-Enabled Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_saml_sso.htm&language=en_US&type=5) |
| JWT signature | RS256 with the private key of the registered certificate | [JWT Bearer Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&type=5) |
| JWT refresh token | Never issued | [JWT Bearer Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&type=5) |
| Mutual TLS port | 8443, API-only user with Enforce SSL/TLS Mutual Authentication | [Mutual Authentication Certificate](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_uploading_mutual_auth_cert.htm&type=5) |
| Delegated endpoint | Reachable from Salesforce, TLS with a trusted-provider certificate | [FAQs for Delegated Authentication](https://help.salesforce.com/s/articleView?id=xcloud.sso_delauthentication_tips.htm&language=en_US&type=5) |

## Check yourself

- Why does Salesforce as service provider need only the IdP's certificate and not its private key?
- What must the JWT `iss` claim contain?
- When should you use Download Metadata on a saved SAML setting?
- When is a mutual authentication certificate the answer instead of the JWT bearer flow?

## Sources

- [SAML Single Sign-On Flows](https://help.salesforce.com/s/articleView?id=xcloud.identity_provider_about.htm&language=en_US&type=5)
- [Step 2: Create a SAML Single Sign-On Setting in Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.sso_service_provider_configuration.htm&language=en_US&type=5)
- [Step 3: Share Your SAML SSO Configuration with Your Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_sp_endpoints.htm&language=en_US&type=5)
- [Enable Salesforce as a SAML Identity Provider](https://help.salesforce.com/s/articleView?id=sf.identity_provider_enable.htm&language=en_US&type=5)
- [Integrate Service Providers as Connected Apps with SAML 2.0](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_saml_sso.htm&language=en_US&type=5)
- [Certificates and Keys](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_about.htm&language=en_US&type=5)
- [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_jwt_flow.htm&type=5)
- [Set Up a Mutual Authentication Certificate for API Login](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_uploading_mutual_auth_cert.htm&type=5)
- [Named Credentials](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_about.htm&type=5)
- [Authentication Protocols for Named Credentials](https://help.salesforce.com/s/articleView?id=sf.nc_auth_protocols.htm&type=5)
- [FAQs for Delegated Authentication](https://help.salesforce.com/s/articleView?id=xcloud.sso_delauthentication_tips.htm&language=en_US&type=5)
- [Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_overview.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams