# SSO, delegated authentication and identity federation

*Integration Architect Study Guide · Evaluate the Current System Landscape · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/integration-architect/evaluate-the-current-system-landscape/sso-delegated-authentication-and-identity-federation*

Matching the landscape's identity systems to the right Salesforce mechanism: delegated authentication, Salesforce as SAML service provider (with JIT provisioning) or identity provider, the SAML assertion and asset token flows, token introspection, renewing client credentials tokens after a 401, and Headless Identity APIs.

- Certification: Salesforce Integration Architect
- Exam section: Evaluate the Current System Landscape
- Study guide: https://www.certifyforce.com/study-guide/integration-architect

**Official exam objective:**

> Given a set of requirements, evaluate the authentication and authorization needs based on the system landscape.

## What the exam expects

- Pick delegated authentication, SAML SSO with Salesforce as service provider, or Salesforce as identity provider from the identity systems in the landscape and the direction of trust.
- Add Just-in-Time provisioning when users must not be created in advance.
- Choose the SAML assertion flow, SAML bearer assertion flow or asset token flow for API access given what the client can hold and what it must identify.
- Validate a presented Salesforce token at an API gateway with token introspection, and renew client credentials tokens correctly after a 401.
- Recommend Headless Identity APIs when external users must register and log in inside an off-platform app.

Key terms: **identity provider (IdP)** (the system that authenticates users and issues assertions), **service provider (SP)** (the app that trusts the IdP), **delegated authentication** (Salesforce calls your web service to check a password), **JIT provisioning** (creating or updating the user from the SAML assertion at first login), **asset token** (a JWT that identifies a connected device).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Delegated auth call | SOAP web service receives username, password and source IP; returns true or false | [Delegated Authentication](https://help.salesforce.com/s/articleView?id=sf.sso_delauthentication.htm&type=5) |
| Delegated auth password policy | Enforced by the endpoint, not Salesforce | [Delegated Authentication](https://help.salesforce.com/s/articleView?id=sf.sso_delauthentication.htm&type=5) |
| JIT provisioning | Creates or updates users from a SAML 2.0 assertion at first login | [Just-in-Time Provisioning for SAML](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_about.htm&language=en_US&type=5) |
| Salesforce as IdP | Integrate the service provider as an external client app or connected app | [Salesforce as a SAML Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_sfdc_idp_saml_parent.htm&language=en_US&type=5) |
| SAML assertion flow | No connected app; no refresh token; one org; no Experience Cloud sites | [SAML Assertion Flow for Accessing the API](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_sso_flow.htm&language=en_US&type=5) |
| SAML bearer assertion flow | App with registered X.509 certificate; assertion signed with private key | [OAuth 2.0 SAML Bearer Assertion Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_SAML_bearer_flow.htm&language=en_US&type=5) |
| Asset token | JWT identifying a device; registers it against Asset data | [OAuth 2.0 Asset Token Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_asset_token_flow.htm&language=en_US&type=5) |
| Introspection endpoint | `/services/oauth2/introspect` with client ID and secret | [OpenID Connect Token Introspection](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oidc_token_introspection_endpoint.htm&language=en_US&type=5) |
| Client credentials renewal | No refresh tokens; request again at the My Domain token endpoint | [OAuth 2.0 Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm&language=en_US&type=5) |
| Headless Identity | External users only | [Headless Identity Flows](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_identity_pointer.htm&language=en_US&type=5) |

## Check yourself

- When is delegated authentication the right choice over SAML SSO?
- Why add Just-in-Time provisioning to SAML SSO?
- Which OAuth flow doesn't require an external client app?
- Why can't a gateway use the user's active status to validate a token?

## Sources

- [Delegated Authentication](https://help.salesforce.com/s/articleView?id=sf.sso_delauthentication.htm&type=5)
- [Configure SSO with Salesforce as a SAML Service Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml.htm&language=en_US&type=5)
- [Just-in-Time Provisioning for SAML](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_about.htm&language=en_US&type=5)
- [Salesforce as a SAML Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_sfdc_idp_saml_parent.htm&language=en_US&type=5)
- [OAuth Authorization Flows](https://help.salesforce.com/s/articleView?language=en_US&id=remoteaccess_oauth_flows.htm&type=5)
- [SAML Assertion Flow for Accessing the API](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_sso_flow.htm&language=en_US&type=5)
- [OAuth 2.0 SAML Bearer Assertion Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_SAML_bearer_flow.htm&language=en_US&type=5)
- [OAuth 2.0 Asset Token Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_asset_token_flow.htm&language=en_US&type=5)
- [OpenID Connect Token Introspection](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oidc_token_introspection_endpoint.htm&language=en_US&type=5)
- [OAuth 2.0 Client Credentials Flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm&language=en_US&type=5)
- [Headless Identity Flows](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_headless_identity_pointer.htm&language=en_US&type=5)
- [Authorization Through External Client Apps or Connected Apps and OAuth 2.0](https://developer.salesforce.com/docs/platform/api-rest/guide/intro-oauth-and-connected-apps.html)
- [Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update)](https://help.salesforce.com/s/articleView?language=en_US&id=release-notes.rn_security_unpw_flow_retirement.htm&release=262&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 8 linked practice questions, and unlimited timed mock exams are included with the Integration Architect pack (USD $19): https://www.certifyforce.com/practice-exams