Salesforce as Service Provider and Identity Provider for SSO

Create an Identity Provider Chain

In an identity provider chain, Salesforce sits in the middle, linking a third-party identity provider with a client app. The third-party identity provider authenticates users for Salesforce, while Salesforce serves as the identity provider for the client app. Users can log in to the third-party identity provider and immediately access Salesforce and the client app. If they log in to the client app, they’re redirected via Salesforce to the third-party identity provider. You can chain identity providers with SAML or OpenID Connect exclusively. Or you can create a chain that implements two different authentication protocols.

For example, you want your users to log in to Google and then directly access Salesforce and your mobile customer service app. To create a SAML-only chain, define your org as a SAML service provider with Google as the identity provider. Then configure Salesforce as a SAML identity provider for your mobile customer service app, which acts as the service provider.

Configure SAML SSO Between Multiple Orgs or Experience Cloud Sites

If your company deploys multiple Salesforce orgs or sites, you can configure an org or site as the identity provider for one or more service provider orgs or sites. With this SAML SSO solution, you save your users from managing multiple passwords.

For example, you manage several Salesforce orgs. You want your users to move between orgs without reauthenticating each time. So you configure one org as a SAML identity provider and set up the other orgs as service providers. When your users log in to the identity provider, they’re automatically authenticated for the service providers. They can access all orgs with a single, strong password.

Configure SSO Between Orgs with the Salesforce Authentication Provider

Salesforce can act as an authentication provider for other orgs, so your users can log in to an org acting as the relying party with credentials from the authentication provider. With this configuration, the relying party also can access data in the authentication provider on behalf of the user. To set up this configuration, create a connected app in the authentication provider org. Then define the Salesforce authentication provider in the relying party org using information from the connected app.

Note When you’re using authentication providers, the service provider is called the relying party. For more information, see Single Sign-On Terminology.

For example, you want your users to log in to two orgs with a single set of credentials. You also want to share information between orgs to enrich user profiles. You create a connected app in the authentication provider org and define the authentication provider in the relying party org. When the user logs in to the relying party, they’re redirected to the authentication provider. The authentication provider verifies the user’s identity and asks for access to the connected app. If the user authorizes access, they’re logged in to the relying party. The relying party can then access Salesforce data from the authentication provider.

See Configure a Salesforce Authentication Provider.

Configuration Help