--- schema_version: "1" id: b72b9901aeeda5b8ce0f08449a50c9fdb739502c7aa2544daec5836b5113e558 title: Create a Native Single Sign-On Experience in Your App collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_native_sso.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_native_sso.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: e2525cd49f49941db1d504269763909e6bdd5fe6e129f3460e8d2d7d811ac47e description: With an optional parameter in the OAuth 2.0 web server flow and user-agent flow, you can build a single sign-on (SSO) experience that feels like your third-party app is integrated with an external identity provider. With this process, you link an OAuth flow to an SSO flow while maintaining control of the experience within your app. This parameter is supported for Experience Cloud sites, so you can use this capability to add SSO to a Headless Identity implementation. This parameter is also supported for My Domain. products: - Security - Cross Cloud release: "264" --- # Create a Native Single Sign-On Experience in Your App With an optional parameter in the OAuth 2.0 web server flow and user-agent flow, you can build a single sign-on (SSO) experience that feels like your third-party app is integrated with an external identity provider. With this process, you link an OAuth flow to an SSO flow while maintaining control of the experience within your app. This parameter is supported for Experience Cloud sites, so you can use this capability to add SSO to a Headless Identity implementation. This parameter is also supported for My Domain. ### Required Editions
Available in: both Salesforce Classic and Lightning Experience
Available in: Enterprise, Unlimited, and Developer Editions
For example, you host a login button within your app that directs users to Google, where they enter their Google credentials. The users are then redirected back to your app. Behind the scenes, the browser briefly redirects to your Experience Cloud site before automatically redirecting to your app or Salesforce. The redirection to Experience Cloud happens so quickly that users don’t see the Experience Cloud login page, so it feels like they went between your app and Google. At the end of the flow, they’re logged in to Google and your app. ![Diagram showing flow of native single sign-on](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/headless_sso_diagram.png) Here’s how the flow works. - In your app, a user chooses to log in with an external identity provider, kicking off a web server flow or user-agent flow with a request to the My Domain or Experience Cloud site authorization endpoint (1). The request includes an `sso_provider` parameter that specifies the name of an external identity provider configured in Salesforce, such as an authentication provider or SAML identity provider. - The browser briefly redirects to the My Domain or Experience Cloud site URL. - Salesforce confirms that an external identity provider is enabled on the org or site’s login page (2). The developer name of the external identity provider configured on the login page must match the name sent in the `sso_provider` parameter. - Salesforce starts an SSO flow and redirects the user to the external identity provider. The user logs in to the provider (3). - The browser briefly redirects to Salesforce again. Your registration or Just-in-Time (JIT) provisioning handlers fire. If you have a login flow enabled for the user’s profile, it runs at this point. Salesforce finishes logging the user in and processes the initial authorization request from your app (4). ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png) Note To ensure that your user doesn’t interact with Salesforce, configure your external client app policies to pre-authorize admin-approved users and ensure that the user profile doesn’t have a login flow. - The browser redirects back to your app and completes the web server or user-agent flow. - The user is now logged in to your app (5). They’re also logged in to the external identity provider. To configure this SSO experience, complete these high-level steps. 1. Set up SSO with an external provider. You can set up a SAML identity provider or an authentication provider. When you set up SSO, note the developer name - To set up SAML SSO, see [SAML SSO with Salesforce as the Service Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_setting_up.htm&type=5&language=en_US). - To set up social login with an authentication provider, such as Google or Facebook, see [Authentication Provider SSO with Salesforce as the Relying Party](https://help.salesforce.com/s/articleView?id=experience.sso_authentication_providers.htm&type=5&language=en_US). 2. Add the external identity provider to your My Domain or Experience Cloud login page. Because you configure Headless Identity through Experience Cloud sites, this step is required to configure SSO for a Headless Identity implementation, even though users never see the Experience Cloud login page. - For My Domain, see [Add Identity Providers to the My Domain Login Page](https://help.salesforce.com/s/articleView?id=xcloud.domain_name_login_id_prov.htm&type=5&language=en_US). - For Experience Cloud, see [Configure Your Login Page](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_pages_configure.htm&type=5&language=en_US). 3. Configure the web server flow or user-agent flow. When you set up the flow, include the `sso_provider` parameter in the authorization request. The value of this parameter must match the developer name of the external identity provider that you set up. - For the web server flow, see [OAuth 2.0 Web Server Flow for Web App Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&type=5&language=en_US). - For the user-agent flow, see [OAuth 2.0 User-Agent Flow for Desktop or Mobile App Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_user_agent_flow.htm&type=5&language=en_US).