{"id":66365,"date":"2024-06-19T08:45:02","date_gmt":"2024-06-19T08:45:02","guid":{"rendered":"https:\/\/logmeonce.com\/resources\/2023\/08\/10\/salesforce-single-sign-on-setup\/"},"modified":"2026-10-23T00:00:32","modified_gmt":"2026-10-23T00:00:32","slug":"salesforce-single-sign-on-setup","status":"publish","type":"post","link":"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/","title":{"rendered":"Salesforce Single Sign-On Setup: A Step-by-Step SAML Guide"},"content":{"rendered":"<div class=\"336cb5b64765e27a1a6c1bb71b941f1a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-4830628043307652\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- above content -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-4830628043307652\"\r\n     data-ad-slot=\"5864845439\"\r\n     data-ad-format=\"auto\"\r\n     data-full-width-responsive=\"true\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<\/div>\n<\/p>\n<p>To set up single sign-on in Salesforce, you configure your org as a SAML service provider and trust an external identity provider (IdP) to vouch for your users. In practice that means five things. Deploy a My Domain, collect the IdP\u2019s login URL, issuer and certificate, enable SAML in Single Sign-On Settings, create a SAML configuration that matches those values, and test with a non-admin user before you change anything for everyone. This guide walks through each stage and the mistakes that cause most failed rollouts.<\/p>\n<div data-blg-cta=\"after_tldr\" data-blg-cta-layout=\"banner\" style=\"margin:28px 0;font-family:-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif\">\n<div style=\"border-radius:26px;padding:min(22px,3.2vw)\">\n<div style=\"background:#ffffff;border-radius:18px;overflow:hidden\">\n<div style=\"padding:34px 30px;text-align:center\">\n<div style=\"margin:0 0 18px\"><span style=\"max-width:100%;border-radius:999px;padding:6px 13px;font-size:12px;font-weight:800;letter-spacing:0.1em;text-transform:uppercase;line-height:1.3;background:#F47F24;color:#ffffff\">Logmeonce<\/span><\/div>\n<div style=\"font-size:26px;font-weight:800;line-height:1.2;letter-spacing:-0.01em;color:#1f2937;margin:0\">Strengthen Sign-In Across Your Organization<\/div>\n<div style=\"width:56px;height:6px;border-radius:3px;background:#F47F24;margin:12px 0 14px;margin-left:auto;margin-right:auto\"><\/div>\n<div style=\"font-size:15px;line-height:1.55;color:#64748b;margin:0 0 24px;max-width:44em;margin-left:auto;margin-right:auto\">LogMeOnce offers single sign-on and multi-factor authentication solutions to support identity security for individuals and organizations.<\/div>\n<p><a href=\"https:\/\/logmeonce.com\/resources\" style=\"align-items:center;gap:9px;border-radius:10px;font-weight:700;font-size:15px;text-decoration:none;padding:13px 22px 13px 26px;background:#F47F24;color:#ffffff\">Explore LogMeOnce resources<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_77 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#TLDR\" >TL;DR<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#What_you_are_actually_setting_up\" >What you are actually setting up<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Before_you_start_the_prerequisites_checklist\" >Before you start: the prerequisites checklist<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Step-by-step_configure_SAML_SSO_in_Salesforce\" >Step-by-step: configure SAML SSO in Salesforce<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Step_1_Gather_the_values_from_your_identity_provider\" >Step 1: Gather the values from your identity provider<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Step_2_Enable_SAML_in_Single_Sign-On_Settings\" >Step 2: Enable SAML in Single Sign-On Settings<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Step_3_Create_the_SAML_configuration\" >Step 3: Create the SAML configuration<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Step_4_Send_the_Salesforce_values_back_to_the_IdP\" >Step 4: Send the Salesforce values back to the IdP<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Step_5_Assign_users\" >Step 5: Assign users<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Step_6_Test_then_roll_out\" >Step 6: Test, then roll out<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#The_certificate_trap_IdP_certificate_vs_SP_certificate\" >The certificate trap: IdP certificate vs. SP certificate<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Plan_for_expiry\" >Plan for expiry<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Clock_skew_and_other_silent_login_killers\" >Clock skew and other silent login killers<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Just-in-Time_provisioning_handle_with_care\" >Just-in-Time provisioning: handle with care<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Perspective_SSO_is_only_as_strong_as_the_login_behind_it\" >Perspective: SSO is only as strong as the login behind it<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Adding_a_second_layer_inside_Salesforce\" >Adding a second layer inside Salesforce<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Where_password_management_fits_with_SSO\" >Where password management fits with SSO<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#A_rollout_plan_you_can_copy\" >A rollout plan you can copy<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#FAQ\" >FAQ<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#How_do_I_set_up_single_sign-on_in_Salesforce\" >How do I set up single sign-on in Salesforce?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#What_is_the_difference_between_SSO_and_SAML\" >What is the difference between SSO and SAML?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Is_single_sign-on_enabled_in_Salesforce_by_default\" >Is single sign-on enabled in Salesforce by default?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Why_does_my_Salesforce_SSO_login_fail_with_a_valid_configuration\" >Why does my Salesforce SSO login fail with a valid configuration?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-24\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#How_do_I_add_an_account_to_Salesforce_Authenticator\" >How do I add an account to Salesforce Authenticator?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-25\" href=\"https:\/\/logmeonce.com\/resources\/salesforce-single-sign-on-setup\/#Sources\" >Sources<\/a><\/li><\/ul><\/nav><\/div>\n<h2 id=\"tldr\"><span class=\"ez-toc-section\" id=\"TLDR\"><\/span>TL;DR<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>Salesforce SSO runs on <a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=sf.sso_saml_setting_up.htm&amp;language=en_US\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">SAML<\/a>, with Salesforce as the service provider and your identity provider issuing the login assertions.<\/li>\n<li>Most failures come from three causes: the wrong certificate, clock drift between the IdP and Salesforce, and attribute mapping errors in Just-in-Time (JIT) provisioning.<\/li>\n<li>Keep a way in: test with a regular user, leave one admin on username and password, and calendar the certificate expiry date.<\/li>\n<li>Pair SSO with strong multi-factor authentication, because SSO concentrates risk in one login.<\/li>\n<\/ul>\n<h2 id=\"what-you-are-actually-setting-up\"><span class=\"ez-toc-section\" id=\"What_you_are_actually_setting_up\"><\/span>What you are actually setting up<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Single sign-on lets a person log in once and reach several systems. SAML is one of the standard ways to make that happen. NIST\u2019s glossary describes <a href=\"https:\/\/csrc.nist.gov\/glossary\/term\/saml_single_sign_on\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">SAML as an XML-based protocol<\/a> for exchanging authentication and authorization information, and SSO as the access property that results. So \u201cSSO versus SAML\u201d is not an either-or: SSO is the outcome, SAML is the mechanism.<\/p>\n<p>In Salesforce\u2019s model there are two parties:<\/p>\n<ul>\n<li><strong>Identity provider (IdP):<\/strong> the system that authenticates your employee. It might be your company directory or a dedicated identity service.<\/li>\n<li><strong>Service provider (SP):<\/strong> Salesforce. It does not check a password. It checks a signed assertion from the IdP.<\/li>\n<\/ul>\n<p>Salesforce\u2019s documentation says SAML lets users sign in to a Salesforce org from a <a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=sf.sso_saml_setting_up.htm&amp;language=en_US\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">third-party identity provider<\/a>, and it can also be used to create user accounts automatically. The setup is a trust exchange: each side gets the other\u2019s metadata or certificate, so assertions can be verified.<\/p>\n<h2 id=\"before-you-start-the-prerequisites-checklist\"><span class=\"ez-toc-section\" id=\"Before_you_start_the_prerequisites_checklist\"><\/span>Before you start: the prerequisites checklist<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Skipping this part is the most common reason a two-hour job turns into a two-day one.<\/p>\n<ol>\n<li><strong>A My Domain.<\/strong> SAML login relies on your org\u2019s own domain URL. Deploy it first and confirm users can reach it.<\/li>\n<li><strong>Admin access to both sides.<\/strong> You need a Salesforce System Administrator and someone who can create an application in your IdP.<\/li>\n<li><strong>Federation ID plan.<\/strong> Decide which user field the IdP will send to identify the person: the Salesforce username or a Federation ID. Email addresses are convenient but change when people change names, so many admins prefer an employee ID or a stable user principal name.<\/li>\n<li><strong>A test user<\/strong> with a standard profile, not an admin.<\/li>\n<li><strong>A break-glass admin.<\/strong> Keep at least one administrator able to log in with username and password until SSO is proven. Locking yourself out is a real risk.<\/li>\n<li><strong>Accurate clocks.<\/strong> Check that the IdP server\u2019s time is synchronized, for reasons covered below.<\/li>\n<li><strong>A list of integrations.<\/strong> Mobile apps, API users and sandboxes may behave differently from browser logins.<\/li>\n<\/ol>\n<p>Salesforce also publishes <a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=xcloud.service_provider_prerequisites.htm&amp;language=en_US&amp;type=5\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">prerequisites for SAML service provider integration<\/a> when the org plays the identity provider role instead, which is a different scenario from the one in this article.<\/p>\n<h2 id=\"step-by-step-configure-saml-sso-in-salesforce\"><span class=\"ez-toc-section\" id=\"Step-by-step_configure_SAML_SSO_in_Salesforce\"><\/span>Step-by-step: configure SAML SSO in Salesforce<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The exact screens in your IdP vary, but the Salesforce half is the same everywhere.<\/p>\n<h3 id=\"step-1-gather-the-values-from-your-identity-provider\"><span class=\"ez-toc-section\" id=\"Step_1_Gather_the_values_from_your_identity_provider\"><\/span>Step 1: Gather the values from your identity provider<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Create a SAML application for Salesforce in your IdP, or open the one that already exists. You will need these items from it:<\/p>\n<ul>\n<li>The <strong>Issuer<\/strong> (sometimes called the entity ID)<\/li>\n<li>The <strong>SAML login URL<\/strong> (the IdP\u2019s single sign-on endpoint)<\/li>\n<li>An optional <strong>logout URL<\/strong><\/li>\n<li>The <strong>signing certificate<\/strong> in PEM or CER format, or a metadata XML file that contains it<\/li>\n<\/ul>\n<p>You will also have to give the IdP some Salesforce values, namely the entity ID, the ACS (assertion consumer service) URL and the login URL. Salesforce generates these after you save your configuration, so expect to go back and forth once.<\/p>\n<h3 id=\"step-2-enable-saml-in-single-sign-on-settings\"><span class=\"ez-toc-section\" id=\"Step_2_Enable_SAML_in_Single_Sign-On_Settings\"><\/span>Step 2: Enable SAML in Single Sign-On Settings<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ol>\n<li>In Salesforce, click the gear icon and open <strong>Setup<\/strong>.<\/li>\n<li>Type \u201cSingle Sign-On\u201d in Quick Find and open <strong>Single Sign-On Settings<\/strong>.<\/li>\n<li>Click <strong>Edit<\/strong>, check <strong>SAML Enabled<\/strong>, and save.<\/li>\n<\/ol>\n<p>If the option is missing, the feature may not be available for your org type, and Salesforce support is the right place to ask.<\/p>\n<h3 id=\"step-3-create-the-saml-configuration\"><span class=\"ez-toc-section\" id=\"Step_3_Create_the_SAML_configuration\"><\/span>Step 3: Create the SAML configuration<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>On the same page, create a new configuration, either from metadata or manually. Upload the IdP\u2019s metadata file when you have one, because it fills in the issuer, login URL and certificate with fewer typos. Otherwise, enter them by hand.<\/p>\n<p>The fields that matter most:<\/p>\n<table>\n<thead>\n<tr>\n<th>Field<\/th>\n<th>What to enter<\/th>\n<th>Common mistake<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Issuer<\/td>\n<td>The IdP\u2019s entity ID, exactly as it sends it<\/td>\n<td>Trailing slash or http vs https mismatch<\/td>\n<\/tr>\n<tr>\n<td>Entity ID<\/td>\n<td>The Salesforce-side identifier, usually your My Domain URL<\/td>\n<td>Using the generic login.salesforce.com address<\/td>\n<\/tr>\n<tr>\n<td>Identity Provider Certificate<\/td>\n<td>The IdP\u2019s signing certificate<\/td>\n<td>Uploading the Salesforce certificate instead<\/td>\n<\/tr>\n<tr>\n<td>SAML Identity Type<\/td>\n<td>Username or Federation ID<\/td>\n<td>Choosing one and sending the other<\/td>\n<\/tr>\n<tr>\n<td>Identity Provider Login URL<\/td>\n<td>The IdP\u2019s SSO endpoint<\/td>\n<td>Pasting the IdP\u2019s admin console URL<\/td>\n<\/tr>\n<tr>\n<td>Request Signing Certificate<\/td>\n<td>A Salesforce certificate, if the IdP requires signed requests<\/td>\n<td>Leaving the default when the IdP expects another<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3 id=\"step-4-send-the-salesforce-values-back-to-the-idp\"><span class=\"ez-toc-section\" id=\"Step_4_Send_the_Salesforce_values_back_to_the_IdP\"><\/span>Step 4: Send the Salesforce values back to the IdP<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>After saving, Salesforce shows the endpoints: Login URL, Logout URL, OAuth 2.0 Token Endpoint, and the Entity ID. Copy the Entity ID and ACS URL into your IdP application\u2019s SAML settings. Set the name ID format and the attribute that carries the Federation ID or username to match what you chose in Step 3.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/media.babylovegrowth.ai\/blog-images\/organization-6456\/1792582337012_Salesforce-and-IdP-SAML-settings-mapped.jpeg\" alt=\"Salesforce and IdP SAML settings mapped\" title=\"\"><\/p>\n<h3 id=\"step-5-assign-users\"><span class=\"ez-toc-section\" id=\"Step_5_Assign_users\"><\/span>Step 5: Assign users<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>In your IdP, assign the application to your pilot group. In Salesforce, confirm that each pilot user has a Federation ID or username matching what the IdP will send. If you are using JIT provisioning, see the section below.<\/p>\n<h3 id=\"step-6-test-then-roll-out\"><span class=\"ez-toc-section\" id=\"Step_6_Test_then_roll_out\"><\/span>Step 6: Test, then roll out<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Use a private browser window, and try both flows:<\/p>\n<ul>\n<li><strong>IdP-initiated:<\/strong> start from the IdP\u2019s app dashboard and click the Salesforce tile.<\/li>\n<li><strong>SP-initiated:<\/strong> go to your My Domain URL and choose the SSO option.<\/li>\n<\/ul>\n<p>Once both work for the pilot users, add the SSO button to your login page through My Domain settings, expand to more groups, and only then consider making SSO the required method. Leave the break-glass admin alone until the end.<\/p>\n<h2 id=\"the-certificate-trap-idp-certificate-vs-sp-certificate\"><span class=\"ez-toc-section\" id=\"The_certificate_trap_IdP_certificate_vs_SP_certificate\"><\/span>The certificate trap: IdP certificate vs. SP certificate<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Salesforce\u2019s own support content calls out a frequent source of confusion: the IdP certificate comes from your third-party provider and verifies assertions coming in, while the SP certificate is generated in Salesforce and is used for <a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=000386054&amp;language=en_US&amp;type=1\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Salesforce-initiated requests<\/a>. Mixing them up during setup is a classic root cause of authentication failures that never seem to go away.<\/p>\n<p>A rule of thumb that holds up: whatever the IdP signs with goes into the \u201cIdentity Provider Certificate\u201d field. Whatever Salesforce signs with is for the IdP to import, and only if you enabled signed requests.<\/p>\n<h3 id=\"plan-for-expiry\"><span class=\"ez-toc-section\" id=\"Plan_for_expiry\"><\/span>Plan for expiry<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Certificates expire, and an expired IdP certificate stops verification. Salesforce\u2019s guidance on <a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=000386054&amp;language=en_US&amp;type=1\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">replacing an expired certificate<\/a> notes that this blocks user access to the org. Typical IdP certificates last one to three years, and Salesforce\u2019s help material says self-signed Salesforce certificates run <a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=sf.sso_saml_setting_up.htm&amp;language=en_US\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">one or two years<\/a>, depending on key size.<\/p>\n<p>Put the expiry date in a shared calendar with a reminder at least 30 days ahead, and name a person responsible, not a team alias. When the IdP rotates its certificate, upload the new one in Single Sign-On Settings before the old one stops signing, or coordinate a maintenance window with your break-glass admin ready.<\/p>\n<h2 id=\"clock-skew-and-other-silent-login-killers\"><span class=\"ez-toc-section\" id=\"Clock_skew_and_other_silent_login_killers\"><\/span>Clock skew and other silent login killers<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>SAML assertions are time-limited. Salesforce\u2019s troubleshooting article states that assertions have a <a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=000386054&amp;language=en_US&amp;type=1\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">five-minute validity window with a 30-second allowance<\/a> for clock skew. If the IdP\u2019s server time drifts past that, users see login errors while the configuration looks perfectly correct. Check NTP synchronization on any IdP you host yourself.<\/p>\n<p>Other things to check when the login fails:<\/p>\n<ul>\n<li><strong>Wrong login URL.<\/strong> Users bounce between the IdP and Salesforce, or land on an error page.<\/li>\n<li><strong>Identity mismatch.<\/strong> The IdP sends an email address, but Salesforce expects the username or a Federation ID that differs.<\/li>\n<li><strong>Inactive or frozen users.<\/strong> SSO does not override a deactivated Salesforce account.<\/li>\n<li><strong>Marketing Cloud.<\/strong> It has its own SSO flow, and Salesforce notes it can be <a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=000388896&amp;language=en_US&amp;type=1\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">sensitive to changing IP addresses<\/a>, so networks that cycle public IPs may see persistent SAML errors.<\/li>\n<\/ul>\n<p>A SAML tracer browser extension helps enormously. Capture the assertion, then compare the issuer, audience, recipient and name ID against your Salesforce configuration, one field at a time.<\/p>\n<h2 id=\"just-in-time-provisioning-handle-with-care\"><span class=\"ez-toc-section\" id=\"Just-in-Time_provisioning_handle_with_care\"><\/span>Just-in-Time provisioning: handle with care<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>JIT provisioning creates a Salesforce user the first time someone signs in through SSO. According to Salesforce, it can <a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=sf.sso_saml_setting_up.htm&amp;language=en_US\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">reduce administrative workload<\/a>, but it depends on correct mapping of SAML attributes such as email or username to Salesforce user fields. Bad mappings are a frequent cause of \u201cuser not created\u201d and \u201cpermission denied\u201d errors.<\/p>\n<p>Before turning it on:<\/p>\n<ol>\n<li>List the required fields for a Salesforce user: username, email, last name, alias, profile and so on.<\/li>\n<li>Make sure the IdP sends every one of them as an attribute.<\/li>\n<li>Decide how profile and role are assigned. A default that grants too much is worse than no automatic account at all.<\/li>\n<li>Test with two users who should land in different profiles.<\/li>\n<\/ol>\n<p>JIT creates accounts, but it is not a complete lifecycle tool. When someone leaves, the IdP will stop authenticating them, though the Salesforce user record remains until someone deactivates it, and a username and password login may still exist. Pair SSO with a deprovisioning process.<\/p>\n<h2 id=\"perspective-sso-is-only-as-strong-as-the-login-behind-it\"><span class=\"ez-toc-section\" id=\"Perspective_SSO_is_only_as_strong_as_the_login_behind_it\"><\/span>Perspective: SSO is only as strong as the login behind it<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>We see SSO projects treated as a convenience project, and that undersells the risk. When one identity unlocks Salesforce, email, file storage and finance tools, an attacker who gets that one login gets everything. Convenience is real, but so is concentration.<\/p>\n<p>Our view is that three habits matter more than any single setting:<\/p>\n<ul>\n<li><strong>Make the primary login phishing-resistant.<\/strong> A strong, unique password is the floor. Passwordless MFA and biometric authentication remove the password as the thing to steal.<\/li>\n<li><strong>Keep non-SSO credentials under control.<\/strong> Break-glass admins, API users and service accounts still have passwords. Those need a vault, rotation and an owner.<\/li>\n<li><strong>Watch for exposure.<\/strong> Credentials leaked elsewhere are tried against your systems. Dark web monitoring tells you before the attacker does.<\/li>\n<\/ul>\n<p>This lines up with NIST\u2019s federation guidance. NIST\u2019s Digital Identity Guidelines, <a href=\"https:\/\/csrc.nist.gov\/pubs\/sp\/800\/63\/4\/final\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">updated in July 2025<\/a>, treat federation as something that needs careful management of authentication and assertions, and relying parties such as Salesforce must be able to trust that assertions are verified. Configure signature validation properly and do not turn it off to \u201cget it working\u201d.<\/p>\n<p>An SSO rollout that ends with a working login but leaves old passwords, shared spreadsheets and unmanaged service accounts untouched has solved the smaller half of the problem.<\/p>\n<blockquote>\n<p><em>\u2014 Mike<\/em><\/p>\n<\/blockquote>\n<h2 id=\"adding-a-second-layer-inside-salesforce\"><span class=\"ez-toc-section\" id=\"Adding_a_second_layer_inside_Salesforce\"><\/span>Adding a second layer inside Salesforce<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>SSO does not replace MFA, it moves where MFA happens. If your IdP enforces MFA, users satisfy it there. If a user logs in with a Salesforce username and password, Salesforce\u2019s own requirement applies. Salesforce describes its Authenticator as a mobile app that <a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=002620371&amp;language=en_US&amp;type=1\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">satisfies the MFA requirement<\/a>, and users can register it at first login or later through <a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=000391796&amp;language=en_US&amp;type=1\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Advanced User Details<\/a> in personal settings.<\/p>\n<p>Two practical points. Have users install the app before they start registration, and have them set up a backup in the app at that moment, since Salesforce stresses that this prevents an admin ticket when a phone is lost or replaced.<\/p>\n<p>For highly sensitive apps, Salesforce also documents forced authentication: adding a <a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=xcloud.service_provider_prerequisites.htm&amp;language=en_US&amp;type=5\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">ForceAuthn parameter<\/a> to the SAML request makes users who are already signed in re-enter credentials. That is a useful control for actions such as approving payments or exporting data. Note that Salesforce documents this for the scenario where its org acts as the identity provider, so confirm how your own configuration handles it before relying on it.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/media.babylovegrowth.ai\/blog-images\/organization-6456\/1792582362951_Adding-a-second-layer-inside-Salesforce-overview-diagram.jpeg\" alt=\"Adding a second layer inside Salesforce \u2014 overview diagram\" title=\"\"><\/p>\n<h2 id=\"where-password-management-fits-with-sso\"><span class=\"ez-toc-section\" id=\"Where_password_management_fits_with_SSO\"><\/span>Where password management fits with SSO<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Even a well-run SSO deployment leaves gaps: apps that do not support SAML, admin consoles with local logins, shared team credentials and the IdP account itself. A password manager covers those.<\/p>\n<p>If you want one place to handle both, our <a href=\"https:\/\/logmeonce.com\/business-pricing-and-comparison\/\" target=\"_blank\" rel=\"noopener\">LogMeOnce business plans<\/a> include Teams at $4.00 per month per user and Business at $7.99 per month per user, with Enterprise available as a custom option. For individuals who manage their own accounts, the <a href=\"https:\/\/logmeonce.com\/password-manager\/\" target=\"_blank\" rel=\"noopener\">Professional, Ultimate and Family plans<\/a> start at $2.50 per month, and our <a href=\"https:\/\/logmeonce.com\/passwordless-mfa\" target=\"_blank\" rel=\"noopener\">passwordless MFA<\/a> page explains how to remove the password from the daily login. If you want to see what a rollout could save before you commit, try the <a href=\"https:\/\/logmeonce.com\/password-manager-roi-calculator\" target=\"_blank\" rel=\"noopener\">password manager ROI calculator<\/a>.<\/p>\n<h2 id=\"a-rollout-plan-you-can-copy\"><span class=\"ez-toc-section\" id=\"A_rollout_plan_you_can_copy\"><\/span>A rollout plan you can copy<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<table>\n<thead>\n<tr>\n<th>Week<\/th>\n<th>Task<\/th>\n<th>Owner<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>1<\/td>\n<td>Deploy My Domain, choose identity field, list integrations<\/td>\n<td>Salesforce admin<\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>Create the IdP application, export metadata<\/td>\n<td>IdP admin<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Configure SAML in a sandbox and test both flows<\/td>\n<td>Both<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Document certificate expiry and reminders<\/td>\n<td>Security lead<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>Pilot with 5 to 10 users, capture failures<\/td>\n<td>Salesforce admin<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>Roll out by group, communicate the new login<\/td>\n<td>IT and managers<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>Review remaining password logins, audit inactive users<\/td>\n<td>Security lead<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Working in a sandbox first is cheap and removes most surprises. Salesforce certificates and endpoints will differ between sandbox and production, so do not copy values blindly when you move.<\/p>\n<h2 id=\"faq\"><span class=\"ez-toc-section\" id=\"FAQ\"><\/span>FAQ<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 id=\"how-do-i-set-up-single-sign-on-in-salesforce\"><span class=\"ez-toc-section\" id=\"How_do_I_set_up_single_sign-on_in_Salesforce\"><\/span>How do I set up single sign-on in Salesforce?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Deploy My Domain, open Setup, go to Single Sign-On Settings, enable SAML and create a configuration with your identity provider\u2019s issuer, login URL and certificate. Then copy Salesforce\u2019s entity ID and ACS URL back into the IdP and assign users. Test with a non-admin account before you roll out widely.<\/p>\n<h3 id=\"what-is-the-difference-between-sso-and-saml\"><span class=\"ez-toc-section\" id=\"What_is_the_difference_between_SSO_and_SAML\"><\/span>What is the difference between SSO and SAML?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>SSO is the result: one login that opens several systems. SAML is a standard, XML-based protocol that carries the proof of login between the identity provider and the application. SAML is one common way to deliver SSO, and other protocols such as OpenID Connect can too.<\/p>\n<h3 id=\"is-single-sign-on-enabled-in-salesforce-by-default\"><span class=\"ez-toc-section\" id=\"Is_single_sign-on_enabled_in_Salesforce_by_default\"><\/span>Is single sign-on enabled in Salesforce by default?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>No. An admin has to turn on SAML in Single Sign-On Settings and create a configuration. Until then, users sign in with their Salesforce username and password, plus whichever MFA method applies.<\/p>\n<h3 id=\"why-does-my-salesforce-sso-login-fail-with-a-valid-configuration\"><span class=\"ez-toc-section\" id=\"Why_does_my_Salesforce_SSO_login_fail_with_a_valid_configuration\"><\/span>Why does my Salesforce SSO login fail with a valid configuration?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Check three things first: whether the IdP certificate in Salesforce is the one the IdP actually signs with, whether the IdP\u2019s clock is within the allowed skew, and whether the name ID matches the username or Federation ID in Salesforce. A SAML tracer shows which of these is wrong in minutes.<\/p>\n<h3 id=\"how-do-i-add-an-account-to-salesforce-authenticator\"><span class=\"ez-toc-section\" id=\"How_do_I_add_an_account_to_Salesforce_Authenticator\"><\/span>How do I add an account to Salesforce Authenticator?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Install the app, then choose the Salesforce Authenticator option at your next login, or connect it from Advanced User Details in your personal settings. Set up the backup account during registration so you can move to a new phone without an admin.<\/p>\n<h2 id=\"sources\"><span class=\"ez-toc-section\" id=\"Sources\"><\/span>Sources<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=sf.sso_saml_setting_up.htm&amp;language=en_US\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">SAML SSO with Salesforce as the Service Provider, Salesforce Help<\/a><\/li>\n<li><a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=000386054&amp;language=en_US&amp;type=1\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Replace an Expired Certificate in SSO Settings, Salesforce Help<\/a><\/li>\n<li><a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=xcloud.service_provider_prerequisites.htm&amp;language=en_US&amp;type=5\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Complete Prerequisites for SAML Service Provider Integration, Salesforce Help<\/a><\/li>\n<li><a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=000388896&amp;language=en_US&amp;type=1\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Marketing Cloud Single Sign-On Implementation Overview, Salesforce Help<\/a><\/li>\n<li><a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=002620371&amp;language=en_US&amp;type=1\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">How to Set Up Salesforce Authenticator for MFA, Salesforce Help<\/a><\/li>\n<li><a href=\"https:\/\/help.salesforce.com\/s\/articleView?id=000391796&amp;language=en_US&amp;type=1\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Connect Multi-factor Authenticator to a User Account, Salesforce Help<\/a><\/li>\n<li><a href=\"https:\/\/csrc.nist.gov\/glossary\/term\/saml_single_sign_on\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Security Assertion Markup Language Single Sign-On, NIST CSRC Glossary<\/a><\/li>\n<li><a href=\"https:\/\/csrc.nist.gov\/pubs\/sp\/800\/63\/4\/final\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">SP 800-63-4, Digital Identity Guidelines, NIST CSRC<\/a><\/li>\n<\/ul>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>Set up Salesforce single sign-on with SAML: prerequisites, step-by-step configuration, JIT provisioning, certificate and clock-skew fixes, and testing tips.<\/p>\n","protected":false},"author":17,"featured_media":248434,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[19736],"tags":[1294,3604,6050,781,3563,8032,2493],"class_list":["post-66365","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-single-sign-on","tag-authentication","tag-identity-management","tag-salesforce","tag-security","tag-setup","tag-single-sign-on","tag-user-authentication"],"acf":[],"_links":{"self":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/66365","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/comments?post=66365"}],"version-history":[{"count":1,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/66365\/revisions"}],"predecessor-version":[{"id":248433,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/66365\/revisions\/248433"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media\/248434"}],"wp:attachment":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media?parent=66365"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/categories?post=66365"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/tags?post=66365"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}