Identity Management Concepts17% of the exam
SAML, OpenID Connect and delegated authentication patterns
How federated SSO (SAML and OpenID Connect), delegated authentication and certificate-based login differ: who checks the credentials, which messages flow, and which pattern fits SP- or IdP-initiated logins, social sign-on, identity provider chains and org-to-org SSO.
Describe common authentication patterns and understand the differences between each one.
~8 min read · 12 practice questions ·
What the exam expects
- Tell federated authentication (SAML or OpenID Connect SSO) apart from delegated authentication by who checks the credentials and what Salesforce receives.
- Describe the service provider-initiated and identity provider-initiated SAML flows, and pick the one a requirement (deep links, portal tiles) needs.
- Explain how OpenID Connect adds authentication to OAuth 2.0, and label the parties as identity provider, service provider, OpenID provider or relying party.
- Recommend an identity provider chain, a Salesforce authentication provider between orgs, social sign-on or certificate-based login from a scenario.
Key terms: identity provider (authenticates the user); service provider / relying party (the app that trusts it); SAML assertion (signed XML facts about the user); ID token (signed JWT returned with the openid scope); delegated authentication (Salesforce asks a customer web service to check a password); Is Single Sign-On Enabled (the user permission that turns delegation on).
Key facts
Delegated callout payload
- Detail
- Username, password and source IP; service returns true or false
Delegated password storage
- Detail
- Disposed of immediately, never stored or logged
Who delegates
- Detail
- Users with Is Single Sign-On Enabled, for UI and API logins
Password reset with delegation
- Detail
- Disabled; users are directed to their admin
IdP-initiated SAML
- Detail
- No SAML request; the IdP starts with a signed response
ID token
- Detail
- Signed JWT returned with the openid scope (web server, user-agent flows)
OpenID Connect apps
- Detail
- No need to enable Salesforce as an identity provider
Authentication providers
- Detail
- Salesforce is always the relying party
Certificate-based login
- Detail
- Not supported in Experience Cloud sites; port 8443
Username-password flow
- Detail
- Blocked by default in orgs created Summer '23 or later
Username-password retirement
- Detail
- Summer '26+ orgs can't enable it; enforced for connected apps February 20, 2027
Sources for this section (9)
- Delegated Authenticationhelp.salesforce.com (opens in a new tab)
- FAQs for Delegated Authenticationhelp.salesforce.com (opens in a new tab)
- SAML Single Sign-On Flowshelp.salesforce.com (opens in a new tab)
- OAuth Tokens and Scopeshelp.salesforce.com (opens in a new tab)
- Salesforce as an Identity Providerhelp.salesforce.com (opens in a new tab)
- Single Sign-On Terminologyhelp.salesforce.com (opens in a new tab)
- Certificate-Based Authenticationhelp.salesforce.com (opens in a new tab)
- Block Authorization Flowshelp.salesforce.com (opens in a new tab)
- Username-Password Flow Retirementhelp.salesforce.com (opens in a new tab)
- Why does delegated authentication remove Salesforce password policies for some users?
- When does an SP-initiated SAML flow fit instead of IdP-initiated?
- Which party is the OpenID provider when Salesforce uses an OpenID Connect authentication provider?
- Why choose a Salesforce authentication provider over SAML between two orgs?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (12 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams