External IdPs and external user models on sites
How an Experience Cloud site accepts outside identity (SAML service provider with site endpoints, authentication providers as relying party, Login Discovery routing to partner IdPs) and how to pick the account and contact model behind each external user: business contact, partner account, person account or contactless user.
Given a set of requirements, determine the best way to support external IdPs in communities and leverage the right user/contact model to support community user experience.
~8 min read · 16 practice questions ·
What the exam expects
- Choose SAML (site as service provider) or an authentication provider (site as relying party) for an external IdP, and route users to partner IdPs from a Login Discovery page.
- Configure a site SAML setting: For Communities endpoints, primary URL, unique Entity ID, Recipient with
sc, login-page options, employees logging in on the site. - Branch provisioning logic per site or entry point:
communityIdin a Custom SAML JIT handler,expidfor authentication provider registration. - Pick the account and contact model for external users: business account contact, partner-enabled account, person account or contactless user.
Key terms: service provider (the site trusts a SAML IdP's assertion); relying party (the site trusts an OpenID Connect or OAuth provider through an authentication provider); For Communities endpoints (per-site SAML URLs Salesforce generates); contactless user (External Identity user with no contact record); person account (one record merging account and contact for B2C).
Key facts
- Detail
- SAML for SSO only; auth provider for SSO plus third-party data
- Detail
- For Communities section; primary URL only
- Detail
- Unique per org, starts with https; generally the site URL
- Detail
- Recipient adds
&sc=<certificate ID>
- Detail
- Allow employees to log in directly to an Experience Cloud site
- Detail
- Branch on
communityId; handler creates account and contact
- Detail
- Salesforce inserts a returned new User;
updateUseron repeat logins
- Detail
expidon the Single Sign-On Initialization URL
- Detail
- Account must be enabled as partner
- Detail
- External Identity only; no Login As, delegated admin or SCIM create
Sources for this section (9)
- Site as SP or Relying Partyhelp.salesforce.com (opens in a new tab)
- Share Your SAML Configurationhelp.salesforce.com (opens in a new tab)
- JIT Fields for Experience Cloudhelp.salesforce.com (opens in a new tab)
- Add SSO Providers to the Login Pagehelp.salesforce.com (opens in a new tab)
- SamlJitHandlerdeveloper.salesforce.com (opens in a new tab)
- RegistrationHandlerdeveloper.salesforce.com (opens in a new tab)
- Authentication Provider User Experiencehelp.salesforce.com (opens in a new tab)
- Self-Registration Apex Controllerhelp.salesforce.com (opens in a new tab)
- Create Contactless Usershelp.salesforce.com (opens in a new tab)
- Why must a site's SAML setting usually use the site URL as Entity ID?
- When does the site need an authentication provider rather than SAML?
- Which parameter lets one registration handler run different logic for two microsites?
- Why can't support agents use Login As on a contactless user?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (16 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams