Hello,

We are having to implement a custom login experience (UI/UX) to enable a user to login into Salesforce community. The IDP (ForgeRock) is external to Salesforce. The previous web app used to make REST calls to IDP for validating the user using a series of screens (including Multi factor authentication) and we've been asked to replicate this behavior. 

At the end of this whole process, once the IDP gives the green light, how do I enable the user to login to Salesforce community. `

`I see that the Site.login(username, password, startUrl) only accepts passwords. Is there any other way for me to login once the IDP completes the authentication and respond back to Salesforce.

I also see that the Site.passwordlesslogin also uses one of a list of verified methods that Salesforce will use to verify the user but may not accept an externally authenticated user.

How can we enable this? Also, is it possible to just customize the login behavior and have the IDP re-direct to Salesforce at the end of this process (assuming we enable SSO configuration in Salesforce & IDP and exchange the relevant meta-data). The only part I'm unsure (as I've not done this before) is if this behavior(re-direct to SP at the end of SAML assertion) achievable without first firing a SAML request from SP (Salesforce) to IDP and have the user enter the credentials in IDP.

Any thoughts/advise would be greatly welcome!

Thank you.