Two pieces have to exist: the web service, and Setup pointing at it. Build the service first, then wire it to one pilot user.
- Download the WSDL
From Setup, enter API in the Quick Find box, select API, then download the Delegated Authentication WSDL. It sits beside the Enterprise and Partner WSDLs.
- Prove Salesforce can reach it
Call the endpoint from outside your own network before you touch Setup. An internal hostname resolves from your desk and fails from Salesforce, which is the usual first-attempt failure.
- Point Salesforce at the endpoint
From Setup, open Single Sign-On Settings, click Edit, and paste the HTTPS address into Delegated Gateway URL. Saving it routes nobody yet.
- Enable one pilot user, not a profile
Assign Is Single Sign-On Enabled through a permission set held by one test account nobody depends on. Log in as that user and watch the request land in your service log.
- Break it on purpose before you go wide
Stop the service, retry the pilot login, then open Delegated Authentication Error History from the Quick Find box. It needs Modify All Data, which is a bad thing to discover at 9am on a Monday.
One field for the whole org. There is no per-profile override, so a phased migration moves people off the permission instead.
Grantable on a profile or a permission set. Use a permission set, so you can pull it from one person without editing a profile everyone shares.
Applies only to users who hold the permission. Everyone else keeps a Salesforce password whatever this box says.
- A sandbox refresh copies the gateway URL, but sandbox usernames carry the sandbox suffix, so your service will not find them.
- Delegated users cannot reset their own password, so your help desk absorbs every reset request.
- An expired certificate on the DMZ host reads as a total outage, because there is no degraded mode.
