Study guide
Study guide for chapter 11 of the Securing Salesforce: Identity and Access course. Read the five modules first; this page helps you check what stuck.
About this study guide. It’s built only from this course’s own content and the published Salesforce exam guide’s list of objectives. It is never based on real exam questions, and it doesn’t claim to know what’s on the exam. If you’ve taken the exam, please don’t send me questions from it: the certification agreement forbids sharing them, and memorizing answers is the wrong way to become an architect anyway.
This chapter carries one of the Identity and Access Management Architect exam’s objectives, choosing the OAuth flow, in its Salesforce as an Identity Provider section, 17% of the exam. The exam guide aligns to Summer ‘23, so check its current version before you book.
For the Exam
Section titled “For the Exam”Tick them off as you go. Each one links to where it’s taught.
Nobody home (supports IDP-1)
- I can say why the integration user and a stored refresh token don’t fit when a change must carry a named person who isn’t there. (Two answers that don’t work)
- I know JWT bearer, the SAML bearer assertion and the SAML assertion flow are one step and never issue a refresh token. (Three tools, one shape)
JWT bearer (supports IDP-1)
- I know JWT bearer needs a certificate on the app, and the JWT signed with the private key, RS256. (The flow)
- I can name the claims:
issthe client ID,subthe username,aud,exp. (Inside the envelope) - I know the grant type,
urn:ietf:params:oauth:grant-type:jwt-bearer, and that no scopes go in the request. (On the wire) - I know it only works for pre-authorized users: Admin approved users are pre-authorized, by profiles and permission sets. (Who it may act as)
The two SAML flows (supports IDP-1)
- I know the SAML bearer assertion is built and signed by the client, with a certificate on the app. (Almost the same name)
- I know the SAML assertion flow reuses the org’s SAML single sign-on, with no app, and its limits: one org, no login flows, no Experience Cloud sites. (Almost the same name)
- I can choose between the tightest trust and borrowed trust. (Choosing)
Token exchange and the asset token (supports IDP-1)
- I know token exchange swaps another identity provider’s token for a Salesforce one, through an Apex token exchange handler. (The swap)
- I know the asset token is for connected devices, linked to an Asset record. (Things, not people)
Beyond the Exam
Section titled “Beyond the Exam”The exam is the floor, not the ceiling. These are the habits from this chapter that an architect needs, whether or not a question ever asks about them.
- A permission set with only the users a system may act as, never a profile, never an admin.
- Guard the private key as the most important secret you have: a vault, never code.
- A short
expand a JWT ID, so a stolen JWT is worth little. - Borrow trust where an identity provider already decides who’s who.
- No passwords in events, messages or logs. Ever.
- A token exchange handler that validates the outside token before it maps anyone.
Words to Know
Section titled “Words to Know”| Term | In one line |
|---|---|
| Impersonation | A system acting as a named person who isn’t there |
| JWT | A JSON Web Token: a header, claims and a signature, joined with dots |
| JWT bearer flow | A JWT naming the user, signed with the app’s private key, exchanged for an access token |
iss, sub, aud, exp | The client ID, the username, the audience, the expiry |
jti | An optional JWT ID that Salesforce checks against replays |
| Pre-authorized | The users an app may act as: Admin approved users are pre-authorized |
| SAML bearer assertion flow | A SAML assertion built and signed by the client, exchanged for an access token |
| SAML assertion flow | The org’s single sign-on assertion exchanged for an API token, with no app |
| Token exchange flow | Another identity provider’s token swapped for a Salesforce one |
| Token exchange handler | The Apex class that validates the outside token and maps it to a user |
| Asset token | A token for a connected device, linked to an Asset record |
| Actor token | The JWT describing the device, sent with the access token for an asset token |
Check Yourself
Section titled “Check Yourself”Short scenarios in the style of the course. Decide your answer before you open it.
1. A nightly job in another company system must update Salesforce records, each change recorded as the user who owns the record. No one will be signed in. Which flow?
JWT bearer, with the job’s certificate on an external client app and the users pre-authorized. Client credentials would record every change as the integration user. Reread Nobody Home.
2. A JWT bearer integration works, then stops a few minutes after each token is issued. The team asks how to refresh it. What do you tell them?
The flow never issues a refresh token. When the access token runs out, sign a new JWT and present it again. Reread On the wire.
3. A team has pre-authorized the Standard User profile on its JWT bearer app. What's the risk, and the fix?
Whoever holds the private key can act as anyone in that profile. Use a permission set that holds only the users the system really needs to act for. Reread Who it may act as.
4. A company already uses SAML single sign-on into Salesforce, and wants its middleware to reach the API as those same users, without creating an app in Salesforce. Which flow, and what limits apply?
The SAML assertion flow: it exchanges the single sign-on assertion for an API token, with no app. It works with one org only, doesn’t run login flows, and isn’t supported on Experience Cloud sites. Reread Almost the same name.
5. A security team won't let one system hold a key that can sign as anyone in theirs, but both systems trust the company's identity provider. What do you propose?
Borrowed trust: let the identity provider sign an assertion for the person, and present that. No system holds a golden pass. Reread Choosing.
6. Customers sign in to a portal outside Salesforce with a third-party identity provider, and the portal must show their Salesforce cases without a Salesforce login. Which flow?
Token exchange: the portal swaps the identity provider’s token for a Salesforce one, and a token exchange handler maps it to the customer’s user. Reread The swap.
7. Connected printers must report their state to a backend service, each one tied to the customer's Asset record. Which flow?
The asset token flow: an app exchanges an access token and an actor token for an asset token that registers the device and links it to its Asset. Reread How a device gets one.
Explore
Section titled “Explore”- OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration (opens in a new tab), Salesforce Help (Winter ‘27; checked 2026-11-07)
- Salesforce Certified Platform Identity and Access Management Architect Exam Guide (opens in a new tab), Salesforce Help (checked 2026-11-07)
The official list of objectives and their weights. Always check the current version before you book an exam.