Configuring Salesforce as a SAML service provider
When Salesforce trusts a third-party identity provider, how the SAML single sign-on setting maps users and validates signatures, how to route users to one of several IdPs, how to require SSO without locking admins out, and how SAML single logout and sandbox refreshes behave.
Given a use case, describe when Salesforce is used as a Service Provider.
~8 min read · 13 practice questions ·
What the exam expects
- Tell when Salesforce is the service provider (or relying party) and when it is the identity provider.
- Configure a SAML single sign-on setting: Issuer, Entity ID, certificates, SAML Identity Type and Location, binding, signature method and URLs.
- Support several identity providers with one setting each and Login Discovery routing.
- Require SSO for employees while keeping a break-glass path for admins, and send users straight to the IdP from My Domain.
- Configure SAML single logout and recover SAML after a sandbox refresh.
Key terms: service provider (the system that trusts another to authenticate users); identity provider (the system that authenticates them); SAML single sign-on setting (Salesforce's record of one trusted IdP); Federation ID (the User field that holds the IdP's identifier for a user); front-channel SLO (logout redirects in the user's own browser).
Key facts
- Detail
- The system that trusts another to authenticate users is the service provider
- Detail
- Must match
<saml:Issuer>and one<saml:Audience>
- Detail
- The error page says username or Federation ID; the setting's Identity Type can also be User ID, read from the Subject or an Attribute
- Detail
- Response signature first; if missing or invalid, the assertion signature
- Detail
- Apex
MyDomainLoginDiscoveryHandler; Login Page Type Discovery
- Detail
- Applies only to users with Is Single Sign-On Enabled
- Detail
- My Domain URL plus
?loginor?login=true
- Detail
- Front-channel only; same browser
- Detail
- SAML disabled, configuration kept except the Salesforce Login URL
Sources for this section (8)
- Single Sign-Onhelp.salesforce.com (opens in a new tab)
- Create a SAML SSO Settinghelp.salesforce.com (opens in a new tab)
- SAML Login Errorshelp.salesforce.com (opens in a new tab)
- SAML Single Sign-On Flowshelp.salesforce.com (opens in a new tab)
- My Domain Login Discoveryhelp.salesforce.com (opens in a new tab)
- Require SSOhelp.salesforce.com (opens in a new tab)
- FAQs for Single Sign-Onhelp.salesforce.com (opens in a new tab)
- SAML SLO as Service Providerhelp.salesforce.com (opens in a new tab)
- Why can one SAML single sign-on setting not serve two different identity providers?
- When does Disable login with Salesforce credentials stop a user from logging in with a password?
- When SAML SSO stops working in a freshly refreshed sandbox, what is the first fix?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (13 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams