---
schema_version: "1"
id: dc31b2f2a315c0ea166c38c7a78d663ffb48aa712266b932de40309c4c13b303
title: Configure the External Client App's SAML 2.0 Settings and Policies
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/configure_external_client_app_saml.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.configure_external_client_app_saml.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 58a31465e3229b09c50ae98e9cf27c220005a80b70d1bfe34e65058ecc122945
description: To integrate a service provider with your Salesforce org, you can use an external client app that implements SAML 2.0 for user authentication. Salesforce supports SAML single sign-on (SSO) when the service provider or the identity provider initiates the flow. To use this option, configure an external client app with SAML 2.0 enabled for your service provider. Define your Salesforce org as the SAML identity provider.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Configure the External Client App's SAML 2.0 Settings and Policies

To integrate a service provider with your Salesforce org, you can use an external client app that implements SAML 2.0 for user authentication. Salesforce supports SAML single sign-on (SSO) when the service provider or the identity provider initiates the flow. To use this option, configure an external client app with SAML 2.0 enabled for your service provider. Define your Salesforce org as the SAML identity provider.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small "><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Professional</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col>
          <col>
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d24052e74">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d24052e74 ">To configure External Client Apps SAML settings</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d24052e74 ">Create, edit, and delete External Client Apps</td>

          </tr>
        </tbody>
      </table>

For example, suppose you build a custom Your Benefits web app that implements SAML 2.0 for user authentication. You want your users to be able to log in to this app with their Salesforce credentials. To set up this SSO flow, configure the Your Benefits web app as an external client app. Define your Salesforce org as the SAML identity provider for the external client app. Your users can now log in to the Your Benefits web app with their Salesforce credentials.

1. Complete the [prerequisites for defining service providers](https://help.salesforce.com/s/articleView?id=xcloud.service_provider_prerequisites.htm&type=5&language=en_US).
2. Create your external client app, and complete its [basic information](https://help.salesforce.com/s/articleView?id=xcloud.create_a_local_external_client_app.htm&release=264.0.0&type=5 "Create an external client app in App Manager. Local external client apps are available only on the org where you create them. Packageable external client apps can be packaged for distribution to other orgs.").
3. In the Web App (Enable SAML Settings) section, select **Enable SAML**.
4. Enter the required information, which is available from your service provider.
    
    Entity ID
    
    The globally unique ID of the service provider. If you’re accessing multiple apps from your service provider, define the service provider. Then use the `RelayState` parameter to append the URL values to direct the user to the correct app after signing in.
    
    ACS URL
    
    The URL for the Assertion Consumer Service. This is the service provider’s endpoint that receives SAML assertions.
    
    Subject Type
    
    Specifies which field defines the user’s identity for the app. Options include the user’s username, federation ID, 15-character user ID, an algorithmically calculated persistent ID, or a custom attribute. A custom attribute can be any custom field added to the User object in the org, as long as it’s one of these data types: Email, Text, URL, or Formula (with Text Return Type). If you select **Custom Attribute** for the subject type, Salesforce displays a Custom Attribute field with a list of the available User object custom fields in the org.
    
    Name ID Format
    
    Specifies the format attribute sent in SAML messages. The default selection is **Unspecified**. Depending on your SAML service provider, you can set the format to email address, persistent, or transient. If you set the format to email address, your identity provider describes org users and Experience cloud users differently in SAML messages. For org users, SAML messages include only the user’s email address. This sample shows the SAML message sent when an org user logs in, with the NameID Format set to `emailAddress`.
    
    ```
    <saml:Subject>
             <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
             sandy@salesforce.com</saml:NameID>
             <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
             <saml:SubjectConfirmationData NotOnOrAfter="2021-02-04T20:24:41.098Z" Recipient=
             "https://playground-test.salesforce.com?so=00DR00000000R6N"/>
             </saml:SubjectConfirmation>
             </saml:Subject>
    ```
    
    For Experience Cloud users, SAML messages append the org ID to the user’s email address. This sample shows the SAML message sent when an Experience Cloud user logs in, with the NameID Format set to `emailAddress`.
    
    ```
    <saml:Subject>
             <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
             00DR00000008fLq@sandy@play-test.com</saml:NameID>
             <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
             <saml:SubjectConfirmationData NotOnOrAfter="2021-02-04T20:17:12.647Z" Recipient=
             "https://playground-test.salesforce.com?so=00DR00000000R6N"/>
             </saml:SubjectConfirmation>
             </saml:Subject>
    ```
    
    If your service provider accepts only the email address and not the org ID, create a custom attribute for email address. See [Configure a Custom Attribute for External Client Apps](https://help.salesforce.com/s/articleView?id=xcloud.configure_custom_attributes_for_external_client_apps.htm&release=264.0.0&type=5 "Create custom attributes to capture useful and unique information. With custom attributes, you can get more information about a user’s identity such as an address or job title. Configure custom attributes for your external client app in the Policies tab.").
    
    Issuer
    
    By default, your org’s My Domain login URL is the standard issuer for your identity provider. If your SAML service provider requires a different value, specify it here.
5. To automatically log users out of the external client app service provider when they log out of Salesforce:
    1. Select **Enable Single Logout**.
    2. Enter the single logout endpoint of the service provider. Salesforce sends logout requests to this URL when users log out of Salesforce. The single logout URL must be an absolute URL that starts with https://.
    3. Provide your service provider with the Salesforce IdP SLO endpoint.
        
        The endpoint is listed in your SAML Login Information as the Single Logout Endpoint. It’s also listed in the SAML Metadata file as the Discovery Endpoint. The format for the endpoint is https://MyDomainName.my.salesforce.com/services/auth/idp/saml2/logout, where MyDomainName is your org’s My Domain name.
    4. Select the HTTP binding type for single logout provided by your service provider.
6. If your service provider requires a unique certificate to validate SAML requests from Salesforce, upload the certificate from your system. Otherwise, leave this setting as `Default IdP Certificate`.
    
    The certificate size is limited to 4 KB.
7. If the service provider gave you a security certificate, select **Verify Request Signatures**. Browse your system for the certificate and upload it.
    
    The certificate is necessary only if you plan to initiate logging in to Salesforce from the service provider and the service provider signs its SAML requests.
    
    ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_important.png)
    
    Important If you upload a certificate, all SAML requests must be signed. If no certificate is uploaded, all SAML requests are accepted.
8. To encrypt the response, select **Encrypt SAML Response** to browse your system for the certificate and upload it. Select an encryption method for encrypting the assertion.
    
    Valid encryption algorithm values are `AES-128` (128-bit key) and `AES-256` (256-bit key).
9. For **Signing Algorithm for SAML Messages**, select **SHA1** or **SHA256** to secure SAML messages sent from your Salesforce org.
    
    As the identity provider, Salesforce applies the selected algorithm to its SAML requests and responses. The selected signing algorithm is applied to single sign-on and single logout messages from your org to the service provider.
10. After you configure all settings for your external client app, save your work.