Single sign-on for sites: SAML and authentication providers
The SSO options for Experience Cloud sites and when each fits: the site as a SAML service provider (with the site login URL), as a relying party through predefined or OpenID Connect authentication providers with a registration handler and the site URL parameter, as an identity provider for an outside app, and SSO for mobile apps with OAuth.
Describe options for Single Sign-On.
~7 min read · 7 practice questions ·
What the exam expects
- Choose the SSO pattern from the direction of trust: site as SAML service provider, site as relying party with an authentication provider, site as identity provider, or SSO for mobile apps.
- Tell when SAML (authentication only) is enough and when an authentication provider fits (authentication plus access to third-party data).
- Extend an org's SAML SSO to a site so users land on the site, not the internal login.
- Put an authentication provider button on a site login page and send users to the site after login.
- Explain what a registration handler does.
Key terms: service provider / relying party (the site trusts a third party to authenticate its users); identity provider (the site authenticates users for another app); authentication provider (Salesforce's framework for predefined providers such as Google and OpenID Connect providers); registration handler (Flow or Apex that creates or updates the Salesforce user after the provider authenticates them); Single Sign-On Initialization URL (the provider URL that starts SSO, where the site parameter is added).
Key facts
- Detail
- Site as SAML service provider
- Detail
- Authentication provider, site as relying party
- Detail
- Use the site login URL; the assertion POST includes /login
- Detail
https://domainName/login?so=orgID
- Detail
- Login & Registration > Login Page Setup
- Detail
- Flow or Apex; creates or updates the user
- Detail
- On the Single Sign-On Initialization URL, sends users to the site
- Detail
- Site as SAML identity provider or OpenID provider
- Detail
- SSO for mobile apps with OAuth
Sources for this section (8)
- Service Provider or Relying Partyhelp.salesforce.com (opens in a new tab)
- SAML for Experience Cloud Siteshelp.salesforce.com (opens in a new tab)
- JIT Assertion Fields for Experience Cloudhelp.salesforce.com (opens in a new tab)
- Add an Authentication Provider to the Login Pagehelp.salesforce.com (opens in a new tab)
- Create an Authentication Provider Registration Handlerhelp.salesforce.com (opens in a new tab)
- Direct Users to a Site after Authenticationhelp.salesforce.com (opens in a new tab)
- Identity Provider or OpenID Providerhelp.salesforce.com (opens in a new tab)
- Single Sign-On for Salesforce Customer Identityhelp.salesforce.com (opens in a new tab)
- Why would a consultant pick a SAML service provider setup over an authentication provider?
- When does the site act as an identity provider?
- What must the SAML assertion POST to a site include?
- Which predefined authentication providers does Help name for site sign-in?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Experience Cloud Consultant pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 37 lessons of the Experience Cloud Consultant guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (7 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams