Delegated authentication versus SAML
Key Takeaway
Delegated authentication is turned on per user with the "Is Single Sign-On Enabled" permission. Some users can log in with an externally managed password while others, such as admins, keep Salesforce passwords. Unlike SAML SSO, users still log in to each app separately.
Delegated authentication and SAML single sign-on (SSO) both let users log in to Salesforce with credentials managed outside Salesforce, but they work in different ways. With delegated authentication, Salesforce checks each login by calling a web service that you build around your own authentication system. With SAML, a trusted identity provider logs the user in and sends Salesforce a signed assertion, so users log in once to reach many apps. The choice decides who controls user passwords and what the login looks like for users.
Log in once or log in to each app
Both methods let users use one set of credentials across multiple apps. What differs is the login experience and the kind of company each one fits.
| SAML SSO | Delegated authentication | |
|---|---|---|
| What the user does | Logs in one time, then can access multiple apps | Uses the same credentials but logs in to each app separately |
| Fits a company that | Already has an identity provider | Has a central credential system, like an LDAP server, that must validate passwords for Salesforce logins |
Two companies each want staff to use one password for Salesforce and for an expense app. Company A sets up SAML SSO. Ana logs in once in the morning and then opens both apps without logging in again. Company B sets up delegated authentication. Ben uses the same credentials for both apps, but he logs in to Salesforce and then logs in again to the expense app.
Federated Authentication, the term for SSO enabled with SAML, is available in All Editions. Delegated Authentication is available only in Professional, Enterprise, Performance, Unlimited, Developer, and Database.com Editions.