Authentication

This information helps you troubleshoot authentication issues when using Mobile Publisher.

• If you use SAML authentication, configure it to use HTTP POST to avoid RelayState cut off.
• Use the default login page if you have only one auth provider.
• Don’t enforce IP restrictions unless you’re required to not allow access to the Experience Cloud site from outside networks or LTE.
• For mobile apps, the ideal setting for refresh token policy is to never expire. This setting provides the best experience for your users.
• Use the “SsoUrl” defined in “.well-known/auth-configuration” to trigger a login request in Experience Cloud sites.
• If there are missing or incomplete CA (Certificate Authority) intermediate certificates, Android users could experience messages stating the Experience Cloud site is unable to load. Some Android devices don’t have trusted intermediate certificates. To resolve this issue, the certificates must be installed and trusted or the certificate chain must be uploaded to Salesforce and associated with the custom domain.
  • Qualys SSL Labs offers a web-based free service (https://www.ssllabs.com/ssltest/analyze.html) that can quickly analyze custom domain URLs and check for incomplete certificate chains.
  • For more information about certificate chains, see Merge a complete certificate chain for custom HTTPS domains.
• If you use reCAPTCHA for your login flow you must specify the login page to open in an in-app browser. Also make sure to use a supported mobile browser (Google). For more information on setting up reCAPTCHA, see Set Up ReCaptcha.