Salesforce SAML assertion

Salesforce also exposes a SAML assertion flow for API access that is distinct from the OAuth 2.0 SAML bearer grant. It can be used by orgs that already federate to Salesforce with SAML 2.0.

Exchange the assertionCopy Anchor Link

import { SalesforceAuth } from "@kysoql/auth";

export function authenticateWithSamlAssertion(
  loginUrl: string,
  samlAssertion: string,
) {
  const auth = new SalesforceAuth({
    loginUrl,
    clientId: "external-client-app-id",
  });
  return auth.samlAssertion({ assertion: samlAssertion });
}

Kysoql sends Salesforce's grant_type=assertion and the SAML 2.0 browser SSO assertion type. The application remains responsible for producing the valid SAML response.

This flow does not issue a refresh token. Experience Cloud sites do not support this Salesforce SAML assertion API flow. Use an Experience Cloud-specific flow instead when authenticating customers or partners through a site.