Salesforce as an Identity Provider17% of the exam
Salesforce as a SAML and OpenID Connect provider
How Salesforce gives identity to third-party systems: enabling the SAML identity provider and SAML-enabled apps (entity ID, ACS URL, subject, Name ID, start URL, single logout), OpenID Connect apps with ID token audiences and custom attributes, Experience Cloud sites as identity providers, canvas signed requests, user provisioning for connected apps and JWT external credentials.
Given a scenario, recommend the Salesforce technologies that should be used to provide identity to the 3rd party system.
~8 min read · 11 practice questions ·
What the exam expects
- Recommend how Salesforce provides identity to a third party: SAML identity provider, OpenID Connect app, canvas app, user provisioning for connected apps, or a JWT external credential.
- Configure a SAML-enabled app (entity ID, ACS URL, subject, Name ID Format, start URL, single logout) and an OpenID Connect app (openid scope, ID token audiences, custom attributes).
- Use an Experience Cloud site as the identity provider for external users.
- Key terms: service provider / relying party (the external app that trusts Salesforce); ACS URL (where the service provider receives SAML assertions); ID token (signed OpenID Connect token describing the user); custom attribute (extra user data sent in an assertion or ID token); signed request (canvas's default authentication).
Key facts
OpenID Connect apps
- Detail
- Don't require enabling Salesforce as an identity provider
SAML assertion lifetime
- Detail
- 5 minutes after issue, 30-second clock-skew buffer
Site metadata
- Detail
- One Community Identity endpoint per Experience Cloud site
Name ID email for site users
- Detail
- Org ID prepended to the email
IdP single logout endpoint
- Detail
- /services/auth/idp/saml2/logout on the My Domain
ID token Token Valid for
- Detail
- 1-720 minutes, default 2
customAttributes-only handler
- Detail
- Run As optional; runs as Automated Process user
Provisioning reconciliation
- Detail
- Only when the wizard runs; no automatic interval
Sources for this section (6)
- Salesforce as an Identity Providerhelp.salesforce.com (opens in a new tab)
- Enable Salesforce as a SAML Identity Providerhelp.salesforce.com (opens in a new tab)
- SAML-Enabled Appshelp.salesforce.com (opens in a new tab)
- OpenID Connect Appshelp.salesforce.com (opens in a new tab)
- Custom Connected App Handlerhelp.salesforce.com (opens in a new tab)
- User Provisioning for Connected Appshelp.salesforce.com (opens in a new tab)
- Why does a SAML service provider reject only Experience Cloud users when Name ID Format is email address?
- When does a canvas app's user never see an approval screen?
- Which ID token setting satisfies a vendor that checks the token's audience?
- What message does Salesforce send when a user clicks an App Launcher tile for a SAML app?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (11 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams