Intricate, Not Hard

Module 1 of 4 in the chapter Thinking Like an Identity Architect, chapter 1 of Securing Salesforce: Identity and Access. Each module stands on its own.

The question this module answers: Why do so many people find identity hard, and what does it actually take?

Set it up once, and it just runs

When I start this class, I ask the room how they feel about identity. A lot of people are a little nervous about it, even people who’ve worked on Salesforce for years. And when I ask why, the answer is nearly always the same: they don’t really deal with it.

That’s the nature of identity. It’s one of those things where you set it up once, and then it just runs. On a project, maybe one or two people get involved. They set it up over a couple of weeks, they get it working, and then nobody touches it for a long time. Single sign-on works every morning. The integration’s token keeps refreshing. Everyone forgets how it was done.

So the skills it needs are skills you don’t get to practice. You might configure single sign-on once every two or three years. Compare that with building a page layout, or a flow, or a report, which you might do every week. That’s why identity feels harder than it is. It isn’t harder. It’s less familiar.

This isn’t rocket science

So here’s my first message to you: this isn’t rocket science. It’s just new to most people.

In fact, if you’re a developer, you’ll spend more energy writing one big Lightning web component than you’ll spend setting up single sign-on. In class, I once set up single sign-on between two Salesforce orgs in about five minutes. To be fair, I had everything ready: both orgs were already prepared, and I didn’t need to test every address. But the setup itself is a handful of screens.

Compared with the other architect domains, identity has less material, too. The integration domain covers far more ground. Identity has fewer topics, and you can build every one of them yourself, in free orgs, which this course has you do.

But it is intricate

Now the other half of the truth. There aren’t many settings. It is literally just a few settings. But it is a little intricate.

Here’s how I explain that. A man takes his car to an auto mechanic because it’s running badly. The mechanic listens to the engine, looks under the hood, picks up one screwdriver, turns one screw, and says, “That’ll be 300 dollars.”

“300 dollars? Just to turn one screw?”

“No,” says the mechanic. “It’s 5 dollars to turn the screw, and 295 to know which screw, and how much to turn it.”

Identity is like that. There aren’t many settings, and the screens themselves are simple. But you have to get every setting just right for it to work: the right address in the right box, the right certificate on the right side, the right value in the right field. One wrong setting and nobody logs in, and the error message doesn’t always tell you which one. The skill isn’t in turning the screw. It’s in knowing which screw.

So when I say identity is intricate, not hard, that’s what I mean. Each step is simple. There are many steps, and they have to be exact, and in the right order.

The real skill: learning the switching

So where is the complexity, if not in the settings? In one thing. The biggest complexity is learning a ping-pong match.

Almost everything in this course is a back-and-forth between a few parties. Your browser goes to Salesforce. Salesforce sends it to a login server. The login server sends it somewhere else, and that place sends it back. A program asks for a token, gets a code, swaps the code for a token, and uses the token. Ping, pong, ping, pong.

Once you learn the steps of that switching, the little dance, the domain opens up. Each new mechanism in this course is the same dance with a different partner, or one more step. You learn one pattern well, and then you learn how each new one differs from it.

That changes how you study. Don’t memorize settings. Learn the steps: who talks to whom, in what order, and what each one carries. Module 3 gives you the diagram for that, the swim lane. If you can draw the dance, you can find the wrong setting, because you can see which step failed.

Build it, so you remember it

Because you won’t practice identity at work very often, practice it here. Every part of this course that can be built in a free Salesforce Developer Edition org has you build it. In chapter 4’s practice you set up two orgs. Chapter 6 makes one of them a service provider, and chapter 7 connects the two. Doing it once with your own hands is worth more than reading it three times.

Then, when it comes up on a project two years from now, you won’t be starting from nothing. You’ll remember the dance, and you’ll know which screw.

What’s next

Module 2: what this course will give you, and the route it takes. Two goals, and one route.

What an architect takes from this

• Identity is intricate, not hard. Few settings, each one exact. Know which screw, and how far to turn it.
• Learn the steps, not the screens. Every mechanism is a back-and-forth; know who talks to whom, in what order, carrying what.
• Write it down when you set it up. It will run for years, and the next person to touch it won’t have been there. A drawing of the dance is the best record.
• Practice what you don’t do every day. Build it in a free org before you need it.

Explore

• Step One: Sign up for Salesforce Developer Edition (opens in a new tab), Salesforce Developers, REST API Developer Guide (checked 2026-11-07): the free org this course builds in.