Use Experience Cloud login as single sign-on for your store customers (SSO)

Use this process to let customers sign in to your StoreConnect store with their Salesforce Experience Cloud credentials. Experience Cloud sites, such as partner portals and support forums, act as the SAML identity provider, and StoreConnect acts as the service provider.

Before you begin

• You need an Experience Cloud site already set up in your Salesforce org.
• You need Salesforce administrator permissions to create certificates, enable the identity provider, and create external client apps.
• Have your store’s domain ready. If your store is served on a path (for example /au or /b2b), have that path too. It changes the URLs you enter.
• Account and Contact records must exist and have synced to the store before a customer tries to log in. See the section below.

:::warning Experience Cloud self-registration is not supported. It relates all new Contact records to a single Account, which is incompatible with how StoreConnect uses the Account to Contact relationship. Create the records another way. :::

Account and contact creation

Account and Contact records have to exist before the customer attempts to log in, with enough time allowed for them to sync to the store. They can be records created by StoreConnect’s checkout process, or records created in Salesforce, provided they are compatible with the records StoreConnect creates.

For example, you could email customers who have completed a purchase inviting them to set a username and password for Experience Cloud login. That flow is not part of the StoreConnect package, so you need to build it to suit your organization and use case.

Step 1: Create a certificate and enable the identity provider

Do this first. The certificate you create here is selected again in step 2.

1. Go to Setup > Certificate and Key Management.

2. Select Create a Self-Signed Certificate.

   

3. Give the certificate a Label and Unique Name.
4. Set Key Size to 2048.
5. Select Save.

6. Go to Setup > Identity Provider.

   

7. Select Enable Identity Provider.
8. Select the certificate you just created.
9. Select Save.

Step 2: Create an external client app

:::note Salesforce no longer allows creating new connected apps. External client apps are the replacement and provide the same SAML functionality for this configuration. :::

:::warning Do not use Migrate to External Client App on an existing Connected App. Best practice is to create a new External Client App from scratch using the steps below. :::

1. Go to Setup > External Client App Manager.
2. Select New External Client App.
3. Configure the basic information:
   • External Client App Name: StoreConnect Customer Single Sign-On
   • API Name: StoreConnect_Customer_Single_SignOn
   • Contact Email: Enter the contact email for Salesforce to use in case they want to contact you or your support team
   • Distribution State: Leave as Default
   • Contact Phone: Enter the contact phone for Salesforce to use in case they want to contact you or your support team
   • Info URL: https://support.storeconnect.com/article/experience-cloud-login
   • Logo Image URL: https://res.cloudinary.com/hzkr6fi81/image/upload/v1779181620/media/StoreConnect_Icon_Logo-100x100.png
   • Icon URL: https://res.cloudinary.com/hzkr6fi81/image/upload/v1779181620/media/StoreConnect_Icon_Logo-100x100.png
   • Description: Allows users to log in to store accounts with an Experience Cloud account
4. Skip the API (Enable OAuth Settings) section.
5. In the Web App (Enable SAML Settings) section, configure the following:
   • Enable SAML: True
   • Entity Id: https://{your-stores-domain.com}/logins/auth/experience_cloud/metadata
   • ACS URL: https://{your-stores-domain.com}/logins/auth/experience_cloud/auth
   • Issuer: https://{your-stores-domain.com}/logins/auth/experience_cloud/metadata
   • Name ID Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
   • Signing Algorithm for SAML Messages: SHA1
   • IdP Certificate: Choose the self-signed certificate you created in the first step.

:::note If your store uses a URL path for region or scope (for example /au, /us, /b2b, /b2c; a path can be any segment after your store domain), include the full path before the SAML route segment in the Entity Id, ACS URL, and Issuer fields:

• Entity Id: https://{your-store-domain}/{your-path}/logins/auth/experience_cloud/metadata

• ACS URL: https://{your-store-domain}/{your-path}/logins/auth/experience_cloud/auth

• Issuer: https://{your-store-domain}/{your-path}/logins/auth/experience_cloud/metadata

Without the path, the AuthnRequest Issuer the store sends will not match the External Client App’s Entity Id and Salesforce returns idpError=1605 Unable to resolve request into a service provider.

Each store with a different path needs its own External Client App. :::

1. Save the changes.

Step 3: Set the app policies

This step produces the Metadata Discovery Endpoint that step 4 needs, so complete it before creating the authentication provider.

1. Edit the app you created in step 2.
2. Add a Custom start page.
3. Enter the Custom Start URL: https://{your-stores-domain.com}/
4. Under Profiles and Permission Sets, add the profiles or permission sets for the Experience Cloud users who should be able to log in to the store.
5. Save.
6. Go to the SAML Policies section, open SAML Login Info, and copy the Metadata Discovery Endpoint. You need it in the next step.

Step 4: Create the authentication provider

1. On the Store record, go to the Authentication Providers related list.
2. Select New.

3. Enter the following values:

   StoreConnect field	Value
   Provider	Experience Cloud
   Authorised Domains	Optional
   Client Id
   Client Secret	(leave blank)
   Provider URL	Metadata Discovery Endpoint from the previous step
   Reset Password URL	Optional

4. If you have a custom domain for your Experience Cloud site, enter it in the Authorised domains field. The Provider URL is automatically authorized, so you only need to add additional domains here. This field supports multiple domains separated by a semi-colon (;).
5. Leave the Client Secret blank. When Client Secret is empty and a Provider URL is set, StoreConnect fetches the current IdP certificate directly from the SAML metadata URL. This keeps the certificate automatically up to date and eliminates the need to manually generate or maintain a certificate fingerprint.
6. Save the record.

Step 5: Verify the login works

1. Open your store in a private browser window.
2. Confirm the Experience Cloud login option appears on the store’s login page.
3. Sign in as an Experience Cloud user whose profile or permission set you added in step 3, and confirm you reach the store signed in as the matching customer.
4. If sign-in fails, see troubleshooting below.

Reset password URL

StoreConnect cannot initiate a password reset for an Experience Cloud account, for security reasons. There is no way to change this.

To give customers a working reset path, set the Reset Password URL field to the identity provider’s own password reset page. The store’s reset password flow then redirects the customer there. If you leave it blank, an Experience Cloud customer who attempts a reset sees “Password reset is not supported for this account. Please contact support for assistance.” See password reset and password changes for SSO accounts for the full detail.

Customers without an Experience Cloud license

To let some customers sign in with Experience Cloud and others sign in another way, whether with a username and password or a different provider, create an additional Authentication Provider record for each method. See authentication providers and single sign-on (SSO).

Troubleshooting

Diagnosing SAML errors with the Identity Provider Event Log

If login fails with a SAML error such as idpError=1605 Unable to resolve request into a service provider or Authentication Failed, go to Setup > Identity Provider Event Log. It records each inbound SAML AuthnRequest with the resolved service provider, the issuer, the requesting user, and whether it succeeded.

Entries showing the service provider as unknown mean the external client app is not resolving SAML requests. Check that the Entity Id, ACS URL, and Issuer match the URLs your store sends, including the store path if it has one. If the configuration looks correct but the error persists, the app is likely in a broken state; recreate it from scratch.