Salesforce SSO in 5 Bullets

For my own edification, I want to summarize single sign-on options with Salesforce as succinctly as possible.

Using non-Salesforce credentials to get into Salesforce

This scenario can be simplified like this: A user already has a username + password combination stored in another system. The user wants to log into Salesforce using that existing username and password, instead of maintaining a separate username and password that's used only to log into Salesforce.

To achieve this, Salesforce allows:

• Delegated Authentication
• Federated Authentication using SAML 2.0
• External authentication providers: Facebook, Google, Janrain, LinkedIn, Microsoft Access Control Service, another Salesforce org, Twitter, any service provider who implements the OpenID Connect protocol

Using Salesforce credentials to get into another app

This scenario can be simplified like this: A user is already logged into Salesforce. The user wants to launch another app without having to authenticate again. Instead, the other app should recognize the user and respond accordingly, based on the the user's Salesforce session.

To facilitate this, Salesforce offers:

• SAML 2.0 Identity Provider
• OAuth 2.0 Authorization Server

Closing thoughts

A company can mix the two approaches above, so that Salesforce becomes an intermediate link in a chain that allows access to a third-party app using credentials maintained in a non-Salesforce system.

SAML 2.0 Single Sign-On (SSO) Tutorial for Salesforce

Conceptually understanding single sign-on (SSO) is great, but actually implementing SSO can be a tricky business. Especially if you don't do it very often. Or if you have no experience with SSO at all. While there are many modes of SSO available for consumer apps, such as OAuth, SAML is still very prevalent in the enterprise applications space.

Salesforce is amazing in that with no hassle and for free (read $0.00), you can set up a SAML SSO environment with two DE orgs, one as a service provider and one as an identity provider. This should give you a fine test bed for exploring the protocol and also for testing integrations with other systems. Unfortunately the best tutorial previously available is now outdated, presenting a challenge to new SSO admins trying to wrap their heads around SAML 2.0 and Salesforce.

To bridge the gap, I consolidated a day's worth of tinkering and re-learning into a single SAML 2.0 SSO Tutorial for Salesforce. I hope that other developers and admins can benefit from this guided exploration of both sides of SAML 2.0, using Salesforce both as an identity provider and as a service provider.

UPDATED April 15, 2014: Thank you, Chuck Mortimore for sharing a link to a more in-depth walkthrough on Developer Force for implementing SAML 2.0 SSO using Salesforce.