Salesforce Identity and Access Management Architect Course

Authentication verifies a user’s identity using credentials or multi-factor methods, and occurs before access is granted. Authorization then determines what resources the authenticated user may access.

Discover how single sign-on lets users access multiple applications with one login by trusting an identity provider and service providers, using saml or oidc standards.

Understand how identity providers authenticate users and how service providers rely on that authentication. Salesforce can act as both, with examples using Google and WordPress.

Define authentication versus authorization, and explain how SAML, OAuth 2.0, and OpenID Connect enable single sign-on with IDP and SP for enterprise and consumer applications.

Explore authorization tokens and bearer tokens, learn how access tokens with limited lifespan replace repeated logins after authentication, and distinguish authentication from authorization with hotel card analogies.

Explore how Saml enables single sign-on between identity providers and service providers, detailing Saml requests and responses, service provider initiated and identity provider initiated flows, and benefits for Salesforce integrations.

Learn how OAuth 2.0 enables authorization to protected resources using access and refresh tokens, scopes, and consent, with roles like resource owner, client, authorization server, and resource server in Salesforce.

OpenID Connect adds an authentication layer to OAuth 2 via an ID token and claims, enabling login with major providers and Salesforce as both provider and relying party.

Compare OpenID Connect and SAML by showing OpenID Connect uses ID tokens and JWT, while SAML uses XML assertions. OIDC is simpler and newer, suited for web and mobile.

Establish trust between identity provider and service provider using SAML and OpenID Connect in Salesforce, which can act as both SP and IdP.

Learn how Salesforce acts as a service provider, authenticating users via an external identity provider like Okta, establishing trust, and enabling login with the Okta authentication flow and MFA.

Configure single sign-on to Salesforce using Okta as the identity provider by setting up a free Okta account, adding the Salesforce integration, and enabling SAML on both Okta and Salesforce.

Learn to log in to Salesforce via IdP-initiated single sign-on with Okta, acting as identity provider and Salesforce as service provider, using a SAML assertion.

Demonstrates IdP-initiated SSO from Okta to Salesforce, with setting up Okta Verify MFA, app access, and login history confirming a SAML IdP initiated flow.

Configure a service-provider initiated SSO to Salesforce with Okta as the identity provider. Learn to enable the SAML SSL configuration, initiate SSO, and inspect the SAML request and response.

Demonstrates configuring an SP-initiated flow to log into Salesforce using Okta as the IDP by adding the Okta option on the login page and performing MFA.

Explore how authentication providers enable single sign-on in Salesforce by integrating third-party identity providers like Okta or Google, using SAML or OpenID Connect, and optionally OAuth 2 for data access.

Configure authentication providers in Salesforce, including predefined, Salesforce managed OpenID Connect, and custom, to enable single sign-on with OAuth and OpenID Connect, and add to login pages and communities.

Configure google as a Salesforce managed authentication provider and add it to the login page, covering provider selection, blank credentials, and the ssl registration handler.

Demonstrates configuring Google as an OpenID Connect managed auth provider in Salesforce, with a registration handler and login page integration, noting Google single sign-on requires a class update to work.

provision users with the registration handler class by implementing create user for first-time logins and update user for subsequent logins, updating third party account links.

Explore the out-of-the-box registration handler class, detailing the create user, can create user, and update user methods, including linking Salesforce users to Google Manage and handling approved emails.

See how to implement and debug a Salesforce RegistrationHandler by enhancing create and update user methods, validating emails, querying users, and syncing profile fields from the auth provider.

Identify and troubleshoot SAML login errors using login history, status fields, and the SAML assertion validator, and decode assertions with browser tools.

Configure delegated authentication in Salesforce by delegating user credentials to an external system like Active Directory, enabling single sign on, and using the delegated gateway URL to validate credentials.

See how Salesforce acts as an identity provider to enable single sign-on with service providers like WordPress, using trust between providers for seamless authentication.

Learn how Salesforce password policies use org wide and profile specific settings to enforce security. Policies require 90 day expiration, eight alphanumeric characters, and no reuse of last three passwords.

Learn about OAuth tokens—authorization code, access token, refresh token, and ID token—and how they enable web server flows, token exchange, and OpenID Connect authentication.

Discover how OAuth scopes define protected resources a connected app can access, how user consent and tokens (refresh tokens) carry those scopes, and examples from CDP, Analytics, and API scopes.

Explore oauth authorization flows in Salesforce, covering username password, client credentials, jwt bearer, refresh token, web server, user agent, asset, and device flows.

Learn how oauth 2.0 username-password flow works with a connected app in Salesforce, including setup, testing with postman, and security considerations that discourage production use.

Explore the OAuth 2.0 web server flow in Salesforce by configuring a connected app, obtaining an authorization code, and exchanging it for an access token.

Learn how to rotate the consumer key and secret for a Salesforce connected app, using a two-step stage-and-apply process in App Manager to update client ID and client secret.

Explore identity verification in Salesforce, including MFA, device activation, and step up authentication, and learn how to configure methods and prioritize verification.

Master Salesforce MFA essentials and its differences from two-factor authentication. Explore verification methods, including authenticator apps, security keys, and SMS or email for external users, plus temporary verification codes.

Enable multi-factor authentication by configuring the identity verification page and forcing MFA for logins, then assign MFA via permission sets or profiles and link Salesforce Authenticator, Google Authenticator, or Authy.

Enable Salesforce MFA for an external auth provider lacking its own MFA, enforcing Salesforce MFA for logins through that provider and prompting user registration.

Learn how Salesforce device activation enhances security by requiring identity verification for unrecognized browsers, devices, or untrusted IPs, and how to manage mfa and device activation for customers and partners.

Demonstrates device activation in Salesforce identity and access management by managing IP- and device-based activations, using authenticator apps, email codes, and SMS OTP.

Master step up authentication by raising session security to high assurance for sensitive actions, using accepted verification methods such as MFA, Salesforce Authenticator, TOTP, or security keys.

Enable event monitoring to access the login event type and download hourly or daily CSV event log files via the event log file browser or REST API.

Learn how Salesforce Identity Connect synchronizes on-premises Active Directory with Salesforce user records in real time for provisioning, deprovisioning, and single sign-on across multiple orgs, noting its retirement.

Explore how Salesforce customer identity leverages an experienced cloud site to enable single sign-on, passwordless and embedded login, self-registration, branding, and identity verification for external and contactless users.

Explore Salesforce editions and licensing, including standard, lightning platform, and experience cloud licenses. Understand permission set licenses and feature licenses, and how they differ in granting access.

Explore standard user licenses, including the Salesforce user license, knowledge only license, and lightning platform license. See how access, storage, and platform objects vary for sales, service, and custom apps.

Explore experience cloud licenses for external users. Learn how customer, customer community plus, and partner community licenses enable access to cases, accounts, contacts, and sales objects, plus reports and dashboards.

Explore Salesforce identity licenses, including identity only, external identity, and identity verification credits add-ons, and learn how identity services are included with paid licenses and SSO use cases.

Enable digital experiences and create an Experience Cloud site using a template, convert site member access, add members, activate, build, and publish to reveal the url.

Enable digital experiences, create and publish an Experience Cloud site, assign a custom profile to members, activate, and brand the community from setup to builder.

Explore Experience Cloud login page types, including default, login discovery, experience builder, and Visualforce pages, and learn how to configure them in setup and administration.

Learn to enable self-registration in Experience Cloud and compare default, Visualforce, configurable, and Experience Builder page types for sign-up, including business accounts and person accounts.

Configure experience cloud social sign-on by creating an auth provider, updating the registration handler, and enabling the Google login option on the login page for seamless authentication.

Modify the registration handler to support social sign-on via Google, handling community and non-community logins by creating or updating users, contacts, and accounts with whitelisted emails.

Customize the experience cloud login page and theme branding with Experience Builder, adjusting logo, background, colors, fonts, images, layout, and CSS overrides.

Brand the Experience Cloud login page by switching to the default page, applying colors, logos, and a background image, and adjusting fonts and theme layout in the Experience Builder.

Branding sets tailor a site’s colors, images, and fonts for specific audiences, applying across the site. Page variation adjusts a single page’s layout and content for those audiences.

Create and edit branding sets, assign a red branding to the red audience, and configure a red page variation for the contact support page.

Explore dynamic branding in experience cloud using the exp id URL parameter to customize logos and right frame pictures across login, verify identity, reset password, and self-registration pages.

Demonstrate dynamic branding using dynamic URLs in a Salesforce Experience Cloud setup, swapping logos via a base community resource URL controlled by the exp id parameter (green or blue).