---
schema_version: "1"
id: bbce8213e3c20f41a640664e2226b0f753fbae3b114d9db346b050017fa759e9
title: Configure SSO to a Salesforce IdP Sandbox Org
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_sso_idp_sandbox_org.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_sso_idp_sandbox_org.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 5622d28ee3d696924f0980fb6a6067002a4b8b72df01f24db1ea3e47cbf16bd5
description: If the B2C instance connects to a Salesforce sandbox org, first configure an External Client App in the production org. Then, configure an Auth Provider in the sandbox org. The Auth Provider uses the External Client App that you set up in the production org.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Configure SSO to a Salesforce IdP Sandbox Org

If the B2C instance connects to a Salesforce sandbox org, first configure an External Client App in the production org. Then, configure an Auth Provider in the sandbox org. The Auth Provider uses the External Client App that you set up in the production org.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_important.png)

Important The External Client App works only if you configure it in the Salesforce org that the Auth Provider uses as the IdP.

## Create an External Client App at the Production Org

Configure an external client app in the production org that can communicate with the OAuth provider for the B2C Merchant Agent.

1. Log in to your Salesforce org.
    
    Log in at login.salesforce.com or at your My Domain URL, if set up by your Salesforce admin, for example, https://company.my.salesforce.com.
2. At the top of the page, click ![Setup](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/setup_icon_no_border.png) and select **Setup**.
3. In the Quick Find box, enter and select **External Client App Manager**.
4. Click **New External Client App**.
5. In the Basic Information tab, complete the required fields and set the distribution state to **Local**.
6. Under API (Enable OAuth Settings), select **Enable OAuth**.
7. For the **Callback URL**, enter `https://login.salesforce.com/`.
    
    After you create the Auth Provider in the sandbox org, copy its callback URL and replace the URL that you entered here.
8. Select these OAuth scopes.
    
    - Access the Identity URL service (id, profile, email, address, phone)
    - Manage user data via APIs (api)
    - Perform requests at any time (refresh\_token, offline\_access)
    - Access unique user identifiers (openid)
9. Leave all other settings at their default values.
10. Click **Create**.

After the external client app is complete, the app provides a consumer key and consumer secret. Use these values to create the OAuth provider in the sandbox.

## Configure the Auth Provider in the Sandbox Org

Before you begin, have the consumer key and secret generated by the external client available for the B2C Commerce Merchant Agent.

1. In the Salesforce sandbox org, create the Registration Handler Apex Class.
    1. At the top of the page, click ![Setup](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/setup_icon_no_border.png) and select **Setup**.
    2. In the Quick Find box, enter Apex Classes, and then select **Apex Classes**.
    3. Click **New**.
    4. Create the B2CRegistrationWrapper class by copying and pasting this code in the class editor.
        
        ```
        global class B2CRegistrationWrapper implements Auth.RegistrationHandler {
                 /**
                 * Instantiates the standard B2C Commerce handler to delegate the logic.
                 */
                 private Auth.B2CCommerceCloudRegistrationHandler getStandardHandler() {
                 return new Auth.B2CCommerceCloudRegistrationHandler();
                 }
                 global User createUser(Id portalId, Auth.UserData data) {
                 // You can add custom pre-processing logic here
                 // Delegate to the standard handler
                 return getStandardHandler().createUser(data);
                 }
                 global void updateUser(Id userId, Id portalId, Auth.UserData data) {
                 // You can add custom logging or attribute mapping here
                 // Delegate to the standard handler
                 getStandardHandler().updateUser(userId, data);
                 }
               }
        ```
2. Save your changes.
    
    This Apex class acts as a wrapper around the standard B2C Commerce registration handler. You can add custom pre-processing logic or attribute mappings as needed.
3. In the Quick Find box, enter Auth Providers, and then select **Auth Providers**.
4. Click **New**.
5. Configure the Auth Provider by entering the field values in the following table.
    
     
    | Field | Value |
    | --- | --- |
    | Provider Type | Salesforce |
    | Name | Enter a descriptive name for the Auth Provider. |
    | Consumer Key | From the Salesforce IdP org, go to the External Client App, select the Settings tab, and then locate the Consumer Key in OAuth Settings. |
    | Consumer Secret | From the Salesforce IdP org, navigate to the External Client App, select the Settings tab, and then locate the Consumer Secret in OAuth Settings. |
    | Authorize Endpoint URL | https://idp-org-hostname/services/oauth2/authorize |
    | Token Endpoint URL | https://idp-org-hostname/services/oauth2/token |
    | Registration Handler Type | Apex |
    | Registration Handler | B2CRegistrationWrapper class |
    | Execute Registration As | Select a user with the Salesforce admin role |
6. Click **Save**.
7. Copy the generated **Callback URL**.
    
    The Auth Provider also generates a single sign-on URL for users to access the sandbox org.
8. Log in to the primary IdP org and open the external client app that you created earlier.
9. Paste the Callback URL into the external client app's **Callback URL** field.
10. Save your changes.