Establishing trust with certificates, metadata and signed tokens
Which certificate goes where when Salesforce is a SAML service provider or identity provider, how Issuer, Entity ID and metadata set up trust, and how JWT bearer signatures, mutual TLS, named and external credentials and the delegated authentication endpoint establish trust between systems.
Describe how trust is established between two systems.
~7 min read · 10 practice questions ·
What the exam expects
- Say which party's certificate goes in which SAML field when Salesforce is the service provider and when it is the identity provider, for signing and for encryption.
- Explain how Issuer and Entity ID tie an assertion to its sender and recipient, and use metadata files or URLs to set up trust in both directions.
- Plan for certificate rotation so partners don't lose SSO.
- Describe how the JWT bearer flow and mutual TLS let servers prove their identity, and how named and external credentials hold trust for outbound callouts.
- List what a delegated authentication endpoint needs for Salesforce to reach and trust it.
Key terms: signing certificate (public half of the key pair that signs a message; the other side validates with it); Issuer / Entity ID (identifiers of the sender and the intended audience); metadata (XML file describing a SAML configuration); JWT bearer flow (a server signs a JWT to get an access token); mutual TLS (both sides present certificates during the TLS handshake); external credential (the authentication protocol and principals behind a named credential).
Key facts
- Detail
- Must match
<saml:Issuer>in the assertion
- Detail
- Must match one
<saml:Audience>value
- Detail
- Self-signed, SHA-256
- Detail
- Once a certificate is uploaded, all SAML requests must be signed
- Detail
- Service provider's certificate; AES-128 or AES-256
- Detail
- RS256 with the private key of the registered certificate
- Detail
- Never issued
- Detail
- 8443, API-only user with Enforce SSL/TLS Mutual Authentication
- Detail
- Reachable from Salesforce, TLS with a trusted-provider certificate
Sources for this section (6)
- Create a SAML SSO Settinghelp.salesforce.com (opens in a new tab)
- Enable Salesforce as a SAML IdPhelp.salesforce.com (opens in a new tab)
- SAML-Enabled Connected Appshelp.salesforce.com (opens in a new tab)
- JWT Bearer Flowhelp.salesforce.com (opens in a new tab)
- Mutual Authentication Certificatehelp.salesforce.com (opens in a new tab)
- FAQs for Delegated Authenticationhelp.salesforce.com (opens in a new tab)
- Why does Salesforce as service provider need only the IdP's certificate and not its private key?
- What must the JWT `iss` claim contain?
- When should you use Download Metadata on a saved SAML setting?
- When is a mutual authentication certificate the answer instead of the JWT bearer flow?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (10 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams