Federated authentication and Delegated authentication in salesforce

Question

Anybody know the difference between Federated authentication and Delegated authentication in salesforce? Can you explain the flow of request in these two methods?

Solution

The main difference is the use of Security Assertion Markup Language (SAML) on Federated Authentication.

Delegated Authentication Use delegated authentication if you have mobile users in your organization, or if you want to enable single-sign on for partner portals or Customer Portals. You must request that this feature be enabled by salesforce.com. This recipe explains delegated authentication in more detail.

Federated Authentication using SAML Federated authentication uses SAML, an industry standard for secure integrations. Investing in SAML with Salesforce.com can be leveraged with other products or services. If you use SAML, you don't have to expose an internal server to the Internet: the secure integration is done using the browser. In addition, Salesforce.com never handles any passwords used by your organization. For more information, see “Configuring SAML Settings for Single Sign-On” in the Salesforce.com online help.

Difference

Delegated authentication has a few drawbacks with respect to federated authentication. First, delegated authentication is inherently **less secure than federated authentication**. Even if encrypted, delegated authentication still sends the username and password (possibly even your network password) over the internet to Force.com. Some companies have policies that preclude a third party for handling their network passwords. Second, delegated authentication **requires much more work for the company implementing it**. The Web services endpoint configured for the org must be developed, hosted, exposed on the Internet, and integrated with the company's identity store.

More detailed flow and code example on delegated

More detailed flow on SSO width SAML

Comments

[Mohammed H]

I configured federated authentication. It is working fine through "Identity provider initiated login". How can I use "service provider initiated login"? What details I should give to sales force? my username and password?