OpenID Connect/Social Sign On/Authentication Provider

Question 1

Describe the OpenID Connect flow?

Answer 1

1. User requests a service from a client application
2. The client app redirects the user to the Authorization Server
3. The user authenticates and authorizes the client
4. The Authorization Server redirects the user to the client application with an Authorization code
5. The client app requests token with the Authorization code
6. The Authorization server returns an access and id token
7. ID token can be used to request user info

Question 2

What is pre-requisite for an OpenID Connect flow?

Answer 2

openid scope needs to be selected

Question 3

What is the name of the parameter that you receive in an OpenID token flow describing User ID properties?

Answer 3

id_token

Question 4

When would you use a Dynamic Client Registration?

Answer 4

When Salesforce plays the role of a client management provider for an API Gateway

Question 5

What setting do you use when setting up the Connected App for the API Gateway in a Dynamic Client Registration scenario?

Answer 5

Initial Access Token for Dynamic Client Registration section → Generate

Question 6

What endpoint can the API Gateway use to check for the validity of an access token before using it?

Answer 6

Introspection endpoint, usually at https://hostname/services/oauth2/introspect

Question 7

What is the terminology used for Authentication Providers / OpenID connect?

Answer 7

Relying party (RP) / Client - The party requesting the authentication access
Authorization Server / OpenID Provider (OP) / Third party - the authentication provider

Question 8

What capability does an External Authentication Provider provide?

Answer 8

External authentication provider lets users log in to Salesforce using their login credentials from a third-party service.
Provide SSO & OAuth based API access to SF.

Question 9

What are the 4 types of Authentication Providers that are supported on Salesforce?

Answer 9

1. Salesforce Managed Authentication Providers
2. Custom implementation of these managed authentication providers (e.g. FB)
3. Other authentication providers that support OpenID Connect
4. Other authentication providers that don’t support OpenID Connect, but use OAuth - use Auth.AuthProviderPluginClass abstract class

Question 10

What are the fields that need to be left empty if using the Salesforce Managed Authentication Providers?

Answer 10

• Consumer Key
• Consumer Secret
• Authorize Endpoint URL
• Token Endpoint URL
• User Info Endpoint URL

Question 11

What does the registration handler class do in the Authentication Provider setup?

Answer 11

1. Create the User in SF the first time the user signs up

2. Update the User in SF subsequently

Question 12

What is the URL you get when you have configured an Authentication Provider to test the connection?

Answer 12

Test-Only Initialization URL.
It redirects you to the authentication provider and asks you to sign in. You’re then asked to authorize your app. After you authorize, you’re redirected to Salesforce.

Question 13

What are the Salesforce Managed Authentication Providers?

Answer 13

Apple, FB, Google, Janrain, LinkedIn, Microsoft, Twitter

Question 14

What are the URL’s that are generated once an Authentication Provider has been created?

Answer 14

• Test-Only Initialization URL
• Single Sign-On Initialization URL
• Existing User Linking URL
• OAuth-Only Initialization URL
• Callback URL

Question 15

What are some of the request parameters that are available when setting up Authentication Providers?

Answer 15

• provAuthorizeEndpointHost
• community
• expid
• prompt
• scope
• site

Question 16

Can Salesforce be used as an Authentication Provider?

Answer 16

Yes - Users can log in to an external app using SF credentials

Question 17

Where is the setup done for Salesforce as an Authentication Provider?

Answer 17

1. Add a Connected App
2. Create an entry in Auth Providers
3. Enter the following
   - Authorize Endpoint URL
   - Token Endpoint URL
   - Default Scopes
   - Custom Error URL
   - Custom Logout URL
   - Registration handler Apex class
   - Use callback URL defined to update the connected app