SSO, delegated authentication and identity federation
Matching the landscape's identity systems to the right Salesforce mechanism: delegated authentication, Salesforce as SAML service provider (with JIT provisioning) or identity provider, the SAML assertion and asset token flows, token introspection, renewing client credentials tokens after a 401, and Headless Identity APIs.
Given a set of requirements, evaluate the authentication and authorization needs based on the system landscape.
~8 min read · 8 practice questions ·
What the exam expects
- Pick delegated authentication, SAML SSO with Salesforce as service provider, or Salesforce as identity provider from the identity systems in the landscape and the direction of trust.
- Add Just-in-Time provisioning when users must not be created in advance.
- Choose the SAML assertion flow, SAML bearer assertion flow or asset token flow for API access given what the client can hold and what it must identify.
- Validate a presented Salesforce token at an API gateway with token introspection, and renew client credentials tokens correctly after a 401.
- Recommend Headless Identity APIs when external users must register and log in inside an off-platform app.
Key terms: identity provider (IdP) (the system that authenticates users and issues assertions), service provider (SP) (the app that trusts the IdP), delegated authentication (Salesforce calls your web service to check a password), JIT provisioning (creating or updating the user from the SAML assertion at first login), asset token (a JWT that identifies a connected device).
Key facts
- Detail
- SOAP web service receives username, password and source IP; returns true or false
- Detail
- Enforced by the endpoint, not Salesforce
- Detail
- Creates or updates users from a SAML 2.0 assertion at first login
- Detail
- Integrate the service provider as an external client app or connected app
- Detail
- No connected app; no refresh token; one org; no Experience Cloud sites
- Detail
- App with registered X.509 certificate; assertion signed with private key
- Detail
- JWT identifying a device; registers it against Asset data
- Detail
/services/oauth2/introspectwith client ID and secret
- Detail
- No refresh tokens; request again at the My Domain token endpoint
- Detail
- External users only
Sources for this section (9)
- Delegated Authenticationhelp.salesforce.com (opens in a new tab)
- Just-in-Time Provisioning for SAMLhelp.salesforce.com (opens in a new tab)
- Salesforce as a SAML Identity Providerhelp.salesforce.com (opens in a new tab)
- SAML Assertion Flow for Accessing the APIhelp.salesforce.com (opens in a new tab)
- OAuth 2.0 SAML Bearer Assertion Flowhelp.salesforce.com (opens in a new tab)
- OAuth 2.0 Asset Token Flowhelp.salesforce.com (opens in a new tab)
- OpenID Connect Token Introspectionhelp.salesforce.com (opens in a new tab)
- OAuth 2.0 Client Credentials Flowhelp.salesforce.com (opens in a new tab)
- Headless Identity Flowshelp.salesforce.com (opens in a new tab)
- When is delegated authentication the right choice over SAML SSO?
- Why add Just-in-Time provisioning to SAML SSO?
- Which OAuth flow doesn't require an external client app?
- Why can't a gateway use the user's active status to validate a token?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Integration Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Integration Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (8 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams