# SAML, OpenID Connect and delegated authentication patterns

*Platform Identity and Access Management Architect Study Guide · Identity Management Concepts · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/identity-management-concepts/saml-openid-connect-and-delegated-authentication-patterns*

How federated SSO (SAML and OpenID Connect), delegated authentication and certificate-based login differ: who checks the credentials, which messages flow, and which pattern fits SP- or IdP-initiated logins, social sign-on, identity provider chains and org-to-org SSO.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Identity Management Concepts
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Describe common authentication patterns and understand the differences between each one.

## What the exam expects

- Tell federated authentication (SAML or OpenID Connect SSO) apart from delegated authentication by who checks the credentials and what Salesforce receives.
- Describe the service provider-initiated and identity provider-initiated SAML flows, and pick the one a requirement (deep links, portal tiles) needs.
- Explain how OpenID Connect adds authentication to OAuth 2.0, and label the parties as identity provider, service provider, OpenID provider or relying party.
- Recommend an identity provider chain, a Salesforce authentication provider between orgs, social sign-on or certificate-based login from a scenario.

Key terms: **identity provider** (authenticates the user); **service provider / relying party** (the app that trusts it); **SAML assertion** (signed XML facts about the user); **ID token** (signed JWT returned with the openid scope); **delegated authentication** (Salesforce asks a customer web service to check a password); **Is Single Sign-On Enabled** (the user permission that turns delegation on).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Delegated callout payload | Username, password and source IP; service returns true or false | [Delegated Authentication](https://help.salesforce.com/s/articleView?id=sf.sso_delauthentication.htm&language=en_US&type=5) |
| Delegated password storage | Disposed of immediately, never stored or logged | [Delegated Authentication](https://help.salesforce.com/s/articleView?id=sf.sso_delauthentication.htm&language=en_US&type=5) |
| Who delegates | Users with Is Single Sign-On Enabled, for UI and API logins | [Delegated Authentication](https://help.salesforce.com/s/articleView?id=sf.sso_delauthentication.htm&language=en_US&type=5) |
| Password reset with delegation | Disabled; users are directed to their admin | [FAQs for Delegated Authentication](https://help.salesforce.com/s/articleView?id=xcloud.sso_delauthentication_tips.htm&language=en_US&type=5) |
| IdP-initiated SAML | No SAML request; the IdP starts with a signed response | [SAML Single Sign-On Flows](https://help.salesforce.com/s/articleView?id=xcloud.identity_provider_about.htm&language=en_US&type=5) |
| ID token | Signed JWT returned with the openid scope (web server, user-agent flows) | [OAuth Tokens and Scopes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&language=en_US&type=5) |
| OpenID Connect apps | No need to enable Salesforce as an identity provider | [Salesforce as an Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_sfdc_idp_parent.htm&language=en_US&type=5) |
| Authentication providers | Salesforce is always the relying party | [Single Sign-On Terminology](https://help.salesforce.com/s/articleView?id=xcloud.sso_terminology.htm&language=en_US&type=5) |
| Certificate-based login | Not supported in Experience Cloud sites; port 8443 | [Certificate-Based Authentication](https://help.salesforce.com/s/articleView?id=xcloud.security_certificate_based_auth.htm&language=en_US&type=5) |
| Username-password flow | Blocked by default in orgs created Summer '23 or later | [Block Authorization Flows](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_disable_username_password_flow.htm&language=en_US&type=5) |
| Username-password retirement | Summer '26+ orgs can't enable it; enforced for connected apps February 20, 2027 | [Username-Password Flow Retirement](https://help.salesforce.com/s/articleView?language=en_US&id=release-notes.rn_security_unpw_flow_retirement.htm&release=262&type=5) |

## Check yourself

- Why does delegated authentication remove Salesforce password policies for some users?
- When does an SP-initiated SAML flow fit instead of IdP-initiated?
- Which party is the OpenID provider when Salesforce uses an OpenID Connect authentication provider?
- Why choose a Salesforce authentication provider over SAML between two orgs?

## Sources

- [Single Sign-On](https://help.salesforce.com/s/articleView?id=xcloud.sso_about.htm&language=en_US&type=5)
- [Delegated Authentication](https://help.salesforce.com/s/articleView?id=sf.sso_delauthentication.htm&language=en_US&type=5)
- [Configure Salesforce for Delegated Authentication](https://help.salesforce.com/s/articleView?id=sf.sso_delauthentication_configuring.htm&language=en_US&type=5)
- [FAQs for Delegated Authentication](https://help.salesforce.com/s/articleView?id=xcloud.sso_delauthentication_tips.htm&language=en_US&type=5)
- [Single Sign-On Terminology](https://help.salesforce.com/s/articleView?id=xcloud.sso_terminology.htm&language=en_US&type=5)
- [SAML Single Sign-On Flows](https://help.salesforce.com/s/articleView?id=xcloud.identity_provider_about.htm&language=en_US&type=5)
- [Step 2: Create a SAML Single Sign-On Setting in Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.sso_service_provider_configuration.htm&language=en_US&type=5)
- [OAuth Tokens and Scopes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&language=en_US&type=5)
- [Salesforce as an Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_sfdc_idp_parent.htm&language=en_US&type=5)
- [Define an Authentication Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_predefined_authentication_provider_parent.htm&language=en_US&type=5)
- [Configure an Authentication Provider Using OpenID Connect](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_openid_connect.htm&language=en_US&type=5)
- [Create an Identity Provider Chain](https://help.salesforce.com/s/articleView?id=xcloud.sso_chain_idps.htm&language=en_US&type=5)
- [Configure a Salesforce Authentication Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_sfdc.htm&language=en_US&type=5)
- [Certificate-Based Authentication](https://help.salesforce.com/s/articleView?id=xcloud.security_certificate_based_auth.htm&language=en_US&type=5)
- [Set Up a Mutual Authentication Certificate for API Login](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_uploading_mutual_auth_cert.htm&type=5)
- [Block Authorization Flows to Improve Security](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_disable_username_password_flow.htm&language=en_US&type=5)
- [Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update)](https://help.salesforce.com/s/articleView?language=en_US&id=release-notes.rn_security_unpw_flow_retirement.htm&release=262&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 12 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams