IntegrationAdvancedoauthsamlsso
Implement OAuth SAML bearer flow for enterprise SSO to Salesforce API
Real World Scenario
Enterprise IdP issues SAML assertions; batch jobs need Salesforce API token without interactive login or stored password.
Expected Answer
• OAuth SAML bearer assertion flow POST to token endpoint
• IdP generates signed SAML assertion for integration service principal
• Connected app configured SAML bearer enabled
• Assertion short-lived 5 minutes single use
• Map SAML attributes to Salesforce integration user FederationIdentifier
• Rotate IdP signing certificate coordinated with connected app
• Prefer JWT if IdP supports over SAML bearer complexity
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Main difference: use case and scale. OAuth SAML bearer assertion flow POST to token endpoint. IdP generates signed SAML assertion for integration service principal. Pick based on your integration pattern and team capability. SAML bearer bridges enterprise IdP to API access—common in bank and government integrations. Optimize for scale and operational observability.
Architect Perspective
SAML bearer bridges enterprise IdP to API access—common in bank and government integrations.