Certified Identity and Access Management Designer

Salesforce issues refresh tokens for the OAuth 2.0 Web Server and User-Agent flows when the refresh_token or offline_access scope is requested. Those refresh tokens can be exchanged for new access tokens after the current access token expires.

Deep linking requires the service provider to receive a request for a protected resource and initiate SAML authentication with the identity provider, so that the user can be returned to that requested resource after authentication. Salesforce documents this as the service provider-initiated SAML flow.

The OAuth 2.0 JWT Bearer Token flow supports server-to-server authentication using a digitally signed JWT and the connected app’s configured certificate, rather than a stored Salesforce username-and-password credential. Salesforce’s developer guidance identifies JWT bearer flow as the server-to-server flow for integrations using a single integration user.

A Connected App restricted to administrator-approved users requires each user to be authorized through a permitted profile or permission set. Users without the required assigned permission set are not authorized for the app and receive the “Failed: Not approved for access” error.

Salesforce Platform licenses are designed for internal users who need to use custom Salesforce apps and custom objects but do not require full Salesforce CRM functionality. SAML single sign-on can authenticate those users through a third-party identity provider; it does not replace the license needed to access the Salesforce application. Identity Only licenses are intended for employees who access only identity services, and External Identity licenses target external users.