function readOnly(count){ }
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
+ Start a Discussion
Robin BarnwellRobin Barnwell 

Can a Salesforce instance act as a Service Provider and connect to itself as an Identity Provider

I have two Salesforce Orgs.  One is the Identity & Service Provider, the other just the Service Provider.

I can get SAML working between the Orgs.  But setting-up the combined Identity & Service Provider Org fails everytime.

I think this might be an "undocumented feature" and you can't connect them???
Best Answer chosen by Robin Barnwell
Robin BarnwellRobin Barnwell
OK, so the feedback from Salesforce techincal support is the product cannot work in this configuration.

If you set-up Salesforce as an Identity Provider then any communities created in that Instance cannot be part of the single sign-on circle of trust.

The only options are either to have 2 instances of Salesforce and connect them together via SAML or buy a new Identity Provider.

Pity its not documented that this configuration doesn't work as I lost 2 days trying to connect my Community to a Local Identity Provider.

Also seems a big hole in the techical architecure.  I'm still not convinced it doesn't work and might try some more experimenting

 

All Answers

Robin BarnwellRobin Barnwell
I think they need to be on different domains in the same org to work, but its not documented
Robin BarnwellRobin Barnwell
OK, so the feedback from Salesforce techincal support is the product cannot work in this configuration.

If you set-up Salesforce as an Identity Provider then any communities created in that Instance cannot be part of the single sign-on circle of trust.

The only options are either to have 2 instances of Salesforce and connect them together via SAML or buy a new Identity Provider.

Pity its not documented that this configuration doesn't work as I lost 2 days trying to connect my Community to a Local Identity Provider.

Also seems a big hole in the techical architecure.  I'm still not convinced it doesn't work and might try some more experimenting

 
This was selected as the best answer