Authentication providers for OpenID Connect and social sign-on
How to choose between a SAML setting, a predefined or OpenID Connect authentication provider, a custom Apex provider and delegated authentication when Salesforce accepts a third party's identity, and how to configure providers: registration handler, Salesforce-managed sandbox apps, PKCE, single logout, the client configuration URLs and their request parameters, and third-party access tokens.
Given a scenario, recommend the authentication mechanism when Salesforce needs to accept 3rd Party Identity.
~8 min read · 17 practice questions ·
What the exam expects
- Recommend the mechanism for accepting a third party's identity: a SAML single sign-on setting, a predefined authentication provider, an OpenID Connect provider, a custom Apex provider, or delegated authentication.
- Know which predefined provider types support single sign-on and which only give third-party data access.
- Configure an authentication provider: app registration, Consumer Key and Secret, endpoints, registration handler, PKCE, Custom Logout URL, and the login page.
- Use Salesforce-managed apps for sandbox prototypes and your own apps for production.
- Pick the right client configuration URL and request parameter (site, prompt) for a requirement, and use the third party's access token.
Key terms: authentication provider (Salesforce's record of a third party that logs users in through OAuth 2.0 or OpenID Connect); relying party (the system that trusts the provider's login, here Salesforce); registration handler (the Apex class or flow that matches, creates or updates the Salesforce user); client configuration URLs (the generated Test-Only, Single Sign-On, Existing User Linking, OAuth-Only and Callback URLs).
Key facts
- Detail
- GitHub and Microsoft Access Control Service: data access only; X: SSO but no data access
- Detail
- Custom provider: custom metadata type plus
Auth.AuthProviderPluginClass
- Detail
- Required for SSO; Apex or Flow
- Detail
- Leave key, secret, endpoints and scopes blank; sandbox only
- Detail
- Use Proof Key for Code Exchange (PKCE) Extension checkbox
- Detail
- Third-party data access, no SSO
- Detail
loginre-authenticates,consentre-authorizes
- Detail
- Sends users to the site; can change the user type created
- Detail
/services/auth/idp/oidc/logouton My Domain; front-channel only
Sources for this section (9)
- Define an Authentication Providerhelp.salesforce.com (opens in a new tab)
- Custom External Authentication Providerhelp.salesforce.com (opens in a new tab)
- Registration Handlerhelp.salesforce.com (opens in a new tab)
- Salesforce-Managed Providerhelp.salesforce.com (opens in a new tab)
- OpenID Connect Providerhelp.salesforce.com (opens in a new tab)
- Add Functionalityhelp.salesforce.com (opens in a new tab)
- Prompt Usershelp.salesforce.com (opens in a new tab)
- Direct Users to a Sitehelp.salesforce.com (opens in a new tab)
- OpenID Connect SLOhelp.salesforce.com (opens in a new tab)
- Why is a custom Apex provider unnecessary for a third party that implements OpenID Connect?
- When should a site start a connection with the OAuth-Only Initialization URL?
- When can an admin leave Consumer Key and Consumer Secret blank on a Google provider?
- Which provider type lets employees log in with Microsoft Entra ID work accounts?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (17 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams