Hello everyone - I have few questions regarding SSO and oAuth boundaries. Thing I am aware: SSO (SAML, OpenId) is for authentication and oAuth (various flows) is for authorisation. So, if a person is logging into SF via Azure using SSO which oAuth flow is being used here?
Also there are some oAuth flows for example JWT flow which offers OpenId connection. So, I assume it is capable enough to authenticate and authorize.
2nd question regarding OAuth 2.0 SAML Bearer Assertion Flow. The heading says " OAuth 2.0 SAML Bearer Assertion Flow for Previously Authorized Apps ". How the user is previously authorized? Few pointers that come to my mind are:
1. In Connected App, we are mentioning allowed profiles/perm sets.
2. Connected App => oAuth scope: All users may self authorize/Admin approved users.
3. User has private key for the X.509 certificate installed on connected app.
Any input will help in getting the basics right. Thank you for your time and attention.
If a person is logging into SF via Azure using SSO which oAuth flow is being used here ?
>> It must be authorisation code and credentials flow.
The below article should answer your second question.
https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_SAML_bearer_flow.htm&type=5
