{"title":"Log in as a customer in Salesforce","slug":"log-in-from-salesforce","url":"https://support.storeconnect.com/articles/log-in-from-salesforce","url_markdown":"https://support.storeconnect.com/articles/log-in-from-salesforce.md","subtitle":null,"summary":"Set up SAML-based login so Salesforce staff can sign in to your store as any customer directly from the contact record, for testing or support.","type":"Help_Documentation","video_url":"","keywords":"log in as customer, salesforce login, saml, single sign-on, sso, impersonate customer, sign in as contact, identity provider, external client app, saml configuration, store variables, customer login","last_modified":"2026-08-21T07:12:35+0000","body_markdown":"When you sign in as a customer, you can do anything they can do, such as place orders, change payment details, check out, etc.\n\nThis feature uses SAML single sign-on. Salesforce authenticates you (the staff member) and passes a signed assertion to the store. The customer's password is not required and is never checked.\n\nFollow these steps to set this up, and to ensure the correct access and permissions are configured, and watch the video demo.\n\n\u003ciframe src=\"https://player.vimeo.com/video/1168286877?badge=0\u0026autopause=0\u0026player_id=0\u0026app_id=58479\" title=\"How to Log in as a Customer from Salesforce\" width=\"720\" height=\"405\"\u003e\u003c/iframe\u003e\n\n## Step 1: Create certificate and enable identity provider\n\n1.  From the Salesforce Setup, search for **Certificate and Key Management**.\n2.  Click **Create a Self-Signed Certificate.**\n\n    ![create a self signed certificate](https://res.cloudinary.com/hzkr6fi81/image/upload/v1781677713/documentation-media/log-in-as-contact/certificate.png)\n    \n3.  Give the key a **Label** and **Unique name**.\n4.  Set the **Key Size** to 2048.\n5.  Select **Save**.\n6.  In the **Salesforce Setup**, search for **Identity Provider.**\n\n    ![What page looks like after enabling Identity Provider for StoreConnect](https://res.cloudinary.com/hzkr6fi81/image/upload/v1781677714/documentation-media/log-in-as-contact/identity-provider-setup.png)\n    \n7.  Click **Enable Identity Provider**.\n8.  Select the certificate you just created.\n9.  Click **Save**.\n\n\n## Step 2: Create an external client app\n\n:::warning\nDo not use **Migrate to External Client App** on an existing Connected App. Best practice is to create a new External Client App from scratch using the steps below.\n:::\n\n1.  In Salesforce Setup, search for **External Client App Manager.**\n2.  Select **New External Client App**.\n3.  Configure the app basic information:\n    -   External Client App Name - **StoreConnect Log In as Contact**\n    -   API Name - **StoreConnect\\_Log\\_In\\_as\\_Contact**\n    -   Contact Email - Enter the contact email for Salesforce to use in case they want to contact you or your support team\n    -   Distribution State - Leave as Default\n    -   Contact Phone - Enter the contact phone for Salesforce to use in case they want to contact you or your support team\n    -   Info URL - `https://support.storeconnect.com/article/log-in-from-salesforce`\n    -   Logo Image URL - [https://res.cloudinary.com/hzkr6fi81/image/upload/v1779181620/media/StoreConnect\\_Icon\\_Logo-100x100.png](https://res.cloudinary.com/hzkr6fi81/image/upload/v1779181620/media/StoreConnect_Icon_Logo-100x100.png)\n    -   Icon URL - [https://res.cloudinary.com/hzkr6fi81/image/upload/v1779181620/media/StoreConnect\\_Icon\\_Logo-100x100.png](https://res.cloudinary.com/hzkr6fi81/image/upload/v1779181620/media/StoreConnect_Icon_Logo-100x100.png)\n    -   Description - Allows users to log into store accounts from Salesforce\n\n    ![Basic information form example](https://res.cloudinary.com/hzkr6fi81/image/upload/v1781677750/documentation-media/log-in-as-contact/Basic_Information.jpg)\n\n4.  Skip the API (Enable OAuth Settings) section.\n5.  In the Web App (Enable SAML Settings) section:\n    -   Enable SAML - True\n    -   Entity Id - https://{your-stores-domain.com}/auth/saml/metadata\n    -   ACS URL - https://{your-stores-domain.com}/auth/saml/auth\n    -   Issuer - https://{your-stores-domain.com}/auth/saml/metadata\n    -   Name ID Format - urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\n    -   Signing Algorithm for SAML Messages - SHA1\n    -   IdP Certificate - Choose the self-signed certificate you created in the first step.\n\n    ![Web app settings](https://res.cloudinary.com/hzkr6fi81/image/upload/v1771215018/knowledge/log-in-as-contact/Web_App_oppcvb.jpg)\n\n:::note\nIf your store uses a URL path for region or scope (for example `/au`, `/us`, `/b2b`, `/b2c`, `/wholesale`, or `/trade`; a path can be any segment after your store domain), set the **ACS URL** to include the full path, and set **Entity Id** and **Issuer** to your Salesforce **identity provider's entity ID**:\n\n- **ACS URL:** `https://{your-store-domain}/{your-path}/auth/saml/auth`\n\n- **Entity Id:** `https://{your-my-domain}.my.salesforce.com`\n\n- **Issuer:** `https://{your-my-domain}.my.salesforce.com`\n\nEntity Id and Issuer are **not** path-scoped URLs. Once the `auth.as_customer_saml_metadata_url` store variable is set (Step 4, and it is required for a path-mounted store), the store sends the identity provider's own entity ID as the AuthnRequest Issuer, so that is the value the External Client App must match.\n\nTo find your identity provider's entity ID, open `https://{your-my-domain}/.well-known/samlidp.xml` and copy the `entityID` value. To confirm what your store actually sends, open the sign-in link and decode the `SAMLRequest` query parameter (base64, then raw-deflate); the `\u003csaml:Issuer\u003e` element is the value to use.\n\nEach store on a path needs its own External Client App. **Several apps can share the same Entity Id and Issuer** and be told apart by their ACS URLs, so a path-mounted store does not need its own dedicated domain.\n\nIf the store variable is not set, the store generates its SAML URLs from the bare domain only, identical to every other store on that domain. Salesforce cannot tell the stores apart, so the feature works for just one store per domain, whichever External Client App was registered first, and fails for the rest with no indication of why.\n\nIf Entity Id and Issuer do not match what the store sends, Salesforce returns **idpError=1605 Unable to resolve request into a service provider**.\n:::\n\n6.  Save the changes.\n\n## Step 3: Set app policies\n\nNext, you need to give access to the external client app by adding it to a profile, permission set or both.\n\n1.  Edit the app.\n2.  Add a Custom start page.\n3.  Enter the Custom Start URL: **https://{your-stores-domain.com}/**\n4.  Select **Profiles** and **Permissions Set**.\n\n    ![Set app policies](https://res.cloudinary.com/hzkr6fi81/image/upload/v1771215020/knowledge/log-in-as-contact/App_Policies_nnkcks.jpg)\n    \n5.  Select any profiles you want to give broad access to, or for tighter control, create a permission set and assign that only to users who should have access to login as a contact from Salesforce.\n6.  Save.\n7.  Scroll down to the **SAML Policies** section, go to **SAML Login Info** and copy the **Metadata Discovery Endpoint**.\n\n    ![Copy metadata discovery url](https://res.cloudinary.com/hzkr6fi81/image/upload/v1771215018/knowledge/log-in-as-contact/SAML_Login_Info_aeoldv.jpg)\n\n\n## Step 4: Set store variables\n\nYou need the **Metadata Discovery Endpoint** you copied at the end of Step 3.\n\n1.  Open your Store in StoreConnect.\n2.  In the Store Variables section, select **New**.\n3.  Call the variable Log in as contact metadata.\n4.  Enter this **Key**: auth.as\\_customer\\_saml\\_metadata\\_url\n5.  **Value** field: Paste the Metadata discovery endpoint you copied in the previous step.\n6.  Save.\n   \n    ![Metadata Discovery Endpoint](https://res.cloudinary.com/hzkr6fi81/image/upload/v1771215019/knowledge/log-in-as-contact/Store_Variable_z9kels.jpg)\n\n## Step 5: Create a log-in link\n\nFor ease of access, create a log-in link for the contact page.\n\n1.  Open the Contact object in Salesforce.\n2.  Create a custom field.\n3.  Enter the **Data Type** as Formula.\n4.  Enter **Log into store** as the **Label**.\n5.  For the **Formula Return Type**, choose **Text**.\n6.  In the **Formula** field, enter this code, but using your own store's domain.\n\n```\nHYPERLINK(\n\"https://{your-stores-domain.com}/auth/saml/sign_in?sfid=\" +\nCASESAFEID(Id),\n\"Click here to log in as \" + FirstName + \" \" + LastName )\n```\n\nMake sure the field is visible to the profiles that will use it by adding the field to the page layout. The feature will now work for those staff who are authorised and have access to the link.\n\n## Step 6: set up multiple stores with login capability\n\nTo set more stores, repeat from **Step 2: Create an External Client App** for each unique store domain or path.\n\n## Update an expiring or expired certificate\n\nTo update a certificate, you need to replace all instances of where the certificate is used. Note that you won't be able to log in as a contact until all steps are updated.\n\nThere are two locations where the new certificate will need to be updated: Identity Provider (In Salesforce Setup) and External Client App (IdP Certificate).\n\n1.  Go to **Setup \u003e Identity Provider**.\n2.  Click **Create a new certificate**.\n\n    ![New Certificate](https://res.cloudinary.com/hzkr6fi81/image/upload/v1781677751/documentation-media/log-in-as-contact/newcert.png)\n    \n3.  Give it a name (e.g. You can make it StoreConnect Log In \\[Month\\])\n4.  Click **Save**.\n5.  Next, update the External Client App's IdP Certificate.\n6.  Test logging in as a contact to verify it is now working with the new certificate.\n     \n\n## Troubleshooting \n\n- Confirm the **Contact** has a **Username**. This confirms the contact has an account created on the store. If it does not have a username, send an invitation. This emails an invite and creates a user on the website (if the field is missing from the page layout, add it). The contact does not need to have accepted the invitation or set a password, but the username must have been created **by sending an invitation**. See the note below on usernames set another way.\n- Ensure the External StoreConnect ID is populated. (If it is empty, click the Lightning button labeled \"Sync to SC\" to populate the ID.)  See [Sync records with StoreConnect IDs](What-Records-Sync-to-your-Website)\n- Check for duplicate Contacts.\n- Ensure the Contact email is unique and not shared with another contact.\n- Review the [Sync Error tool](sync-error-tool) for references to affected records and get them to sync.\n- If login fails with a SAML error (such as **idpError=1605 Unable to resolve request into a service provider** or **Authentication Failed**), check the **Identity Provider Event Log** in Salesforce Setup. It records each inbound SAML AuthnRequest with the resolved service provider, the Issuer, the requesting user, and the success or failure outcome. \nEntries showing the service provider as **unknown** indicate the External Client App is not resolving SAML requests. Start by verifying the Entity Id, ACS URL, and Issuer match the URLs your store sends. If the configuration looks correct but the error persists, the app is likely in a broken state, recreate it from scratch to see if the issue resolves.\n- On a domain shared by several stores, if the **Identity Provider Event Log** shows a different External Client App resolving instead of the one you configured, the `auth.as_customer_saml_metadata_url` store variable has almost certainly not been set for your store. Complete Step 4 for that store, then try again.\n\n### \"Could not find any users matching: {ContactId}\"\n\nThis message means **the SAML side already succeeded**: the service provider resolved, the assertion was signed and accepted, and any store path was handled correctly. Salesforce's Identity Provider Event Log will show **Success** for the request. Only the final step failed, matching the contact to a store user.\n\nStop investigating the External Client App, certificates, and URLs when you see this. The cause is the contact record.\n\nAlmost always, the contact has a **Username that was not created by sending an invitation**, for example one written by a data load, an integration, or the API. The field looks correctly populated in Salesforce, but no matching user was ever created on the website, so there is nothing for the login to match. Two things make this hard to spot:\n\n- The **Username** field looks completely normal on the contact record.\n- Salesforce **refuses to re-invite** the contact, with *\"Cannot invite this Contact because they already have a StoreConnect Username. Please use the Reset Password facility instead.\"* That reads like confirmation that the account is fine.\n\nTo resolve it:\n\n- **Contact has no Username:** send an invitation. The username populates, the website user is created, and login works immediately. The invitation does not need to be accepted.\n- **Contact has a Username but login still fails with this message:** use **Reset Password** to create the website user, or test with a contact that was invited normally."}