Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We need to support the following Authentication flows

  • User 1 logs into Salesforce using Salesforce Credentials

  • User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials

  • User 2 logs into Custom App using Arcot + Ping + Siteminder credentials

Since all the authentication methods above are SAML, I need to find a way to address home realm discovery that is a unusual "mesh" of authentication flows.


How should I set up the IDP and RPs to handle this scenario?

How would home realm discovery work?

share|improve this question
up vote 1 down vote accepted

The first two SF login scenarios, one of User1 and first one of User2 is possible simultaneously which is straight forward.

Before I go further about the last two logins, I am presuming the Custom App you've mentioned is also on Salesfore. From your question, you're already on closer side for a solution as for both logins you are using same IDP. This makes your case easy. If you had two different IDPs that wouldn't be possible as SF doesn't support multiple IDPs.

To login to two different parts(SF defines them as Portals) of Salesforce, we need to define properties for each App. That is define org id and profile id for each portal. You've to switch between these two property files and generate a SAML response, depending on source of your call. You will be logged onto SF or your Custom app based on this portal id.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.