# Salesforce as a SAML and OpenID Connect provider

*Platform Identity and Access Management Architect Study Guide · Salesforce as an Identity Provider · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/salesforce-as-an-identity-provider/salesforce-as-a-saml-and-openid-connect-provider*

How Salesforce gives identity to third-party systems: enabling the SAML identity provider and SAML-enabled apps (entity ID, ACS URL, subject, Name ID, start URL, single logout), OpenID Connect apps with ID token audiences and custom attributes, Experience Cloud sites as identity providers, canvas signed requests, user provisioning for connected apps and JWT external credentials.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Salesforce as an Identity Provider
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a scenario, recommend the Salesforce technologies that should be used to provide identity to the 3rd party system.

## What the exam expects

- Recommend how Salesforce provides identity to a third party: SAML identity provider, OpenID Connect app, canvas app, user provisioning for connected apps, or a JWT external credential.
- Configure a SAML-enabled app (entity ID, ACS URL, subject, Name ID Format, start URL, single logout) and an OpenID Connect app (openid scope, ID token audiences, custom attributes).
- Use an Experience Cloud site as the identity provider for external users.
- Key terms: **service provider / relying party** (the external app that trusts Salesforce); **ACS URL** (where the service provider receives SAML assertions); **ID token** (signed OpenID Connect token describing the user); **custom attribute** (extra user data sent in an assertion or ID token); **signed request** (canvas's default authentication).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| OpenID Connect apps | Don't require enabling Salesforce as an identity provider | [Salesforce as an Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_sfdc_idp_parent.htm&language=en_US&type=5) |
| SAML assertion lifetime | 5 minutes after issue, 30-second clock-skew buffer | [Enable Salesforce as a SAML Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.identity_provider_enable.htm&language=en_US&type=5) |
| Site metadata | One Community Identity endpoint per Experience Cloud site | [Enable Salesforce as a SAML Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.identity_provider_enable.htm&language=en_US&type=5) |
| Name ID email for site users | Org ID prepended to the email | [SAML-Enabled Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_saml_sso.htm&language=en_US&type=5) |
| IdP single logout endpoint | /services/auth/idp/saml2/logout on the My Domain | [SAML-Enabled Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_saml_sso.htm&language=en_US&type=5) |
| ID token Token Valid for | 1-720 minutes, default 2 | [OpenID Connect Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_openid_connect.htm&language=en_US&type=5) |
| customAttributes-only handler | Run As optional; runs as Automated Process user | [Custom Connected App Handler](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_custom_handler.htm&language=en_US&type=5) |
| Provisioning reconciliation | Only when the wizard runs; no automatic interval | [User Provisioning for Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_user_provisioning.htm&language=en_US&type=5) |

## Check yourself

- Why does a SAML service provider reject only Experience Cloud users when Name ID Format is email address?
- When does a canvas app's user never see an approval screen?
- Which ID token setting satisfies a vendor that checks the token's audience?
- What message does Salesforce send when a user clicks an App Launcher tile for a SAML app?

## Sources

- [Salesforce as an Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_sfdc_idp_parent.htm&language=en_US&type=5)
- [Enable Salesforce as a SAML Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.identity_provider_enable.htm&language=en_US&type=5)
- [Integrate Service Providers as Connected Apps with SAML 2.0](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_saml_sso.htm&language=en_US&type=5)
- [Integrate Service Providers as Connected Apps with OpenID Connect](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_openid_connect.htm&language=en_US&type=5)
- [Add Custom Attributes to a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_edit_custom_attributes.htm&language=en_US&type=5)
- [SAML Single Sign-On Flows](https://help.salesforce.com/s/articleView?id=xcloud.identity_provider_about.htm&language=en_US&type=5)
- [Configure Your Experience Cloud Site as an Identity Provider or OpenID Provider](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_sso_idp.htm&language=en_US&type=5)
- [Manage Access Through a Custom Connected App Handler](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_custom_handler.htm&language=en_US&type=5)
- [ConnectedAppPlugin Class](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_ConnectedAppPlugin.htm)
- [Signed Request Authentication](https://developer.salesforce.com/docs/atlas.en-us.platform_connect.meta/platform_connect/canvas_app_signed_req_authentication.htm)
- [User Provisioning for Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_user_provisioning.htm&language=en_US&type=5)
- [Create or Edit a JWT External Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_jwt_ext_cred.htm&language=en_US&type=5)
- [Authentication Protocols for Named Credentials](https://help.salesforce.com/s/articleView?id=sf.nc_auth_protocols.htm&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 11 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams