Example: Configure an Amazon Authentication Provider

Set Up a Registration Handler

Set Up an Amazon Application

1. Go to https://login.amazon.com/manageApps and log in to your Amazon developer account.
2. Click Register new application.
3. Enter and save your application information.
   
4. Expand Web Settings.
5. Copy the Client ID and the Client Secret.
   
6. Leave Allowed Return URLs blank. Later, you populate this field with the Salesforce callback URL. This URL is the address your org uses to reply to the Amazon authorization service during a login.

Create an Amazon Auth. Provider in Salesforce

1. From Setup, enter Auth. Providers in the Quick Find box, and select Auth. Providers | New.
2. For the provider type, select Open ID Connect.
3. Enter a name for your Auth. Provider, such as MyAmazon. Salesforce configures this name as the URL suffix in the callback URL, which is how the application responds to a Salesforce authentication request. For example, if the name and suffix combination is MyAmazon, your SSO URL is similar to https://mydomain_login_url or site_url/services/auth/sso/MyAmazon.
   
4. For Consumer Key, enter the Client ID that you copied earlier.
5. For Consumer Secret, enter the Client Secret.
6. Enter the Amazon endpoints:
   • Authorize Endpoint URL—https://www.amazon.com/ap/oa
   • Token Endpoint URL—https://api.amazon.com/auth/o2/token
   • User Info Endpoint URL—https://api.amazon.com/user/profile
   • Default Scopes—profile

   To learn about endpoints, see Using the Authorization Endpoint Parameter.

7. To use an Apex registration handler, take these steps.
   1. For Registration Handler Type, select Apex.
   2. For Registration Handler, select an existing Apex class that implements the Auth.RegistrationHandler interface. Or, to create an template for the registration handler, click Automatically create a registration handler template. Edit this class later, and modify the default content before using it.
8. To use a flow for your registration handler, take these steps.
   1. For Registration Handler Type, select Flow.
   2. For Registration Handler, select an existing flow of the Identity User Registration flow type.
   3. Select a default profile. A default profile is required to run the registration handler. If you don't specify a default profile here, set the default profile in the flow itself.

      If you use the Authentication Provider User Registration flow template, the profile that you set here is automatically stored in the defaultProfileId variable.

   4. Select a default account. If you use your authentication provider for Experience Cloud sites, this account stores new internal users.

      If you use the Authentication Provider User Registration flow template, the profile that you set here is automatically stored in the defaultAccountId variable.

9. For Execute Registration As, select an execution user to run the Apex class or flow. The user must have the Manage Users permission.

   Execute Registration As provides the context in which the registration handler runs. In production, you typically create a system user for the Execute Registration As user. This way, operations performed by the handler are easily traced back to the registration process. For example, if a contact is created, the system user creates it.

10. Save the settings.

Update Your Amazon Application with the Salesforce Callback URL

1. On the Salesforce Auth. Provider page for Amazon, copy the callback URL.
   
2. On the Amazon application page, click Edit under Web Settings. For Allowed Return URLs, enter the Salesforce callback URL. Save the setting.
   

Test the SSO Connection

1. In Salesforce, go to the detail page for the Amazon Auth. Provider.
2. Copy the Test-Only Initialization URL.
3. Open a browser and enter the test URL. You’re redirected to Amazon.
4. Choose an account, log in, and approve access to the Amazon application.
5. Click Okay. After successful login, you’re redirected to the callback registered with Amazon. Amazon returns information about the user and the application.

Test SSO with Amazon AD

1. Test SSO into your Salesforce org.
   1. In Setup, on the My Domain page under Authentication Configuration, click Edit.
   2. Select your Amazon authentication service, and save the settings.
      
   3. Log out and go to your Salesforce org’s login page for your subdomain.
   4. Choose the Amazon authentication service, and enter your Amazon credentials.
2. Test SSO into your Salesforce Experience Cloud site.
   1. If you haven’t done so already, create the Amazon authentication service account.
   2. Make sure that you have enough licenses for site users.
   3. From Setup, in the Quick Find box, enter Digital Experiences, and then select All Sites.
   4. Click Workspaces next to the site you’d like to edit.
   5. From the Experience Workspaces menu, select Administration and then select Login & Registration.
      
   6. Under Login, select the option to display the Amazon Auth. Provider, and save the settings.
   7. Log out, and go to the site login page.
   8. Choose the Amazon authentication service, and log in with your Amazon credentials.