Salesforce Mobile App: Single Sign-On overview

 

After the user enters the My Domain URL in the Salesforce Mobile App, the IdP must present a standard HTML form. WIA and other challenge-based prompts cause a 401 error or a blank screen.

• For AD FS, an administrator must configure a forms-based authentication endpoint for devices that do not support WIA. See: Configure Intranet Forms-Based Authentication for Devices That Do Not Support WIA

• Note for Microsoft Entra ID users: Forms-based login and WIA configuration are handled by Entra ID directly, so AD FS steps do not apply.

RelayState Configuration & 80-Byte Limits

When the Salesforce Mobile App initiates a SAML login, it includes a RelayState parameter to complete the OAuth handshake and route the user back into the app.

• The SAML 2.0 specification recommends an 80-byte limit for the RelayState. Because Salesforce uses RelayState to pass complex OAuth routing for the mobile app, the payload frequently exceeds 80 bytes.

• Administrators must configure strict IdPs to not enforce the 80-byte limit. If the IdP modifies, URL-encodes, truncates, or drops the RelayState, authentication will fail.

HTTP POST or HTTP Redirect Bindings

The IdP must support HTTP POST or HTTP Redirect bindings. If using AD FS, it is recommended to set HTTP Redirect binding in the Salesforce SSO settings, and keep HTTP POST on the AD FS side. If the SAML AuthnRequest URL exceeds IIS's default maxUrl of 4096 bytes, switch to HTTP POST binding to avoid 404 errors.

Common Issues & Troubleshooting

• Full Site Interface Appears Inside the Salesforce Mobile App

  • This occurs when the RelayState is not returned correctly by the IdP, or when the organization uses IdP-Initiated SSO. Verify the IdP Login URL in your SAML SSO settings does not contain IdP-initiated parameters (e.g., idpinitiatedsignon.aspx or startSSO.ping).
    
    

• 401 Unauthorized Error

  • Occurs when the IdP returns a WIA/NTLM challenge that the mobile webview cannot negotiate. An administrator must configure a forms-based login endpoint for mobile devices and ensure it is accessible from the device's network.
    
    

• Blank or White Screen

  • Typically indicates a redirect loop, an unsupported authentication challenge, or a misconfigured My Domain login page. Confirm the My Domain Authentication Configuration includes your SAML IdP. If Azure AD Conditional Access or Intune app protection policies are blocking the embedded webview, enable native browser authentication.
    
    

• InResponseTo: Invalid SAML Assertion Error

  • Clock skew: The IdP server clock is out of sync with Salesforce. SAML assertions are valid for a short time window. Ensure Network Time Protocol (NTP) is correctly configured on the IdP server.

  • IdP-Initiated SSO in use: The IdP is sending an unsolicited SAML response. Switch to SP-Initiated SSO.

  • Stale assertion: A previously used assertion is being submitted again (e.g., the user navigated back and re-submitted).
    
    

• OAuth Error 1800

  • Occurs when Salesforce cannot use the RelayState value returned in the SAML response.

    • Check that the IdP is not altering, double URL-encoding, or truncating the RelayState.

    • OAuth Timestamp Inactivity: If a user opens the app, initiates SSO, but leaves their phone locked on the IdP login screen for an extended period, the OAuth timestamp expires. Advise the user to force-close the app and retry to generate a fresh OAuth request.
      
      

• Error 403: disallowed_useragent (Google or OpenID Connect SSO)

  • Google blocks OAuth 2.0 and OpenID Connect flows in embedded webviews. Enable native browser authentication in My Domain settings to route the login through the device's default browser (Safari or Chrome).
    
    

• IdP Migration Routing Issues (Clearing Mobile App Cache)

  • If your organization recently migrated IdPs (e.g., from AD FS to Entra ID), mobile users might experience caching issues where the app attempts to route to the old IdP. Instruct users to tap the Gear Icon on the mobile login page, delete their existing Custom Connection, and re-add the My Domain URL to flush the routing state.

Advanced Authentication & Native Browser Support

Some authentication methods (Google OpenID Connect, Hardware Security Keys, Azure AD Conditional Access, Intune policies) require the device's native browser.

To Enable Native Browser Authentication:

1. In Salesforce Setup, go to My Domain > Authentication Configuration.

2. Select Use the native browser for user authentication.

• iOS User Prompt Expected Behavior: When native browser authentication is enabled, iOS users will see a system prompt: "Salesforce wants to Use 'login.salesforce.com' to Sign In." This is an unavoidable Apple iOS security feature (ASWebAuthenticationSession). Users must tap "Continue" to proceed.

• Experience Cloud Note: Native browser authentication is not supported when logging in to an Experience Cloud site through the standard Salesforce Mobile App. However, organizations using Mobile Publisher for Experience Cloud do support native browser authentication.

Microsoft Entra ID (Formerly Azure AD)

Microsoft Entra ID is the recommended modern replacement for AD FS. If your organization uses Entra ID, many AD FS-specific issues in this article (NTLM/WIA, forms-based configuration) do not apply. Entra ID handles authentication through its own cloud-based flow.

For complete setup instructions, including mobile app testing steps, see the latest official Microsoft tutorial: Configure Salesforce for Single Sign-On in Microsoft Entra ID

If your organization is currently planning an AD FS migration, see: AD FS Decommission Reference

 

NOTE: For MDM (Mobile Device Management) and EMM (Enterprise Mobility Management) certificate-based authentication, see: Salesforce Mobile App MDM and EMM Support and Troubleshooting.