Overview

A Salesforce consulting partner engaged Ennovision Technology Solutions to design and implement a secure Single Sign-On (SSO) journey for a customer-facing Salesforce Experience Cloud environment.

The requirement went beyond simply enabling authentication. Users authenticating through an external system needed to be automatically recognised, provisioned within Salesforce when required, given the appropriate access, and redirected seamlessly to the correct destination within the Experience Cloud site.

Ennovision designed and developed the underlying Salesforce solution, covering custom Apex development, Just-in-Time provisioning, Experience Cloud configuration, security and profile alignment, automated testing, deployment and production configuration.

The result was a production-ready authentication journey designed to reduce manual administration while providing users with a simpler and more reliable login experience.

The Challenge

The existing requirement involved integrating an external authentication journey with Salesforce Experience Cloud.

The solution needed to address three important challenges simultaneously.

First, authentication had to be seamless. Once a user had successfully authenticated externally, Salesforce needed to recognise the user and establish the appropriate session without introducing unnecessary additional login steps.

Second, the organisation wanted to avoid manually creating and maintaining Salesforce records for every user. New users therefore needed to be provisioned dynamically as part of their first authentication journey.

Finally, the solution needed to be robust enough for production use. Duplicate users, API timeouts, incorrect access permissions, deep-linking after authentication and deployment-specific configuration all had to be considered as part of the engineering design.

This transformed what might initially appear to be an SSO configuration exercise into a broader identity, provisioning and Salesforce Experience Cloud engineering challenge.

The Ennovision Solution

Ennovision implemented the solution across five key areas: authentication engineering, Just-in-Time provisioning, Experience Cloud configuration, security, and production deployment.

— Custom Salesforce Authentication  Handler

At the heart of the solution was a custom Apex Auth.Registration Handler implementation.

— Just-in-Time User Provisioning

A key feature of the architecture was Just-in-Time (JIT) provisioning.

When an authenticated user entered Salesforce, the solution could automatically create the required records rather than relying on administrators to provision every user beforehand.

The provisioning logic incorporated integrated data-integrity checks to ensure that records were created correctly and consistently.

This significantly changes the operational model. Instead of:

Authenticate → administrator creates/updates user → configure access → user enters Salesforce

the target journey becomes:

Authenticate → validate → provision automatically → provide appropriate access → redirect user

The approach provides a foundation for supporting larger user populations without creating a corresponding increase in Salesforce administration.

Engineering for Real-World Exceptions

Authentication systems have to deal with more than the ideal user journey.

Ennovision therefore incorporated custom error-handling logic covering scenarios including duplicate email addresses and API timeouts.

Custom error-page handling was included so that technical failures could be translated into a controlled user experience rather than exposing users to unclear system behaviour.

This was complemented by Apex unit testing using HttpCalloutMock to validate authentication and login scenarios while improving test coverage and supporting controlled debugging.

Salesforce Experience Cloud Configuration

The authentication journey was integrated directly into the Salesforce Experience Cloud site.

Using Experience Builder, Ennovision configured the required login and redirect functionality and validated the user experience across multiple device types.

Particular attention was given to post-authentication deep-linking.

This meant users could authenticate and still be directed to the appropriate destination within the Experience Cloud environment rather than simply being returned to a generic landing page.

For customer and partner portals, preserving this journey can be important to maintaining a frictionless digital experience.

Security and Access Control

Authentication alone does not determine what a user should be able to see or do once inside Salesforce.

Ennovision therefore configured the relevant site access and Field-Level Security (FLS) and established an appropriate baseline profile configuration.

This ensured that authentication, provisioning and authorisation were considered together rather than treating SSO as an isolated technical component.

The approach helped ensure that successfully authenticated users received access aligned with the intended Salesforce security model.

Testing the Complete User Journey

The solution was subjected to end-to-end testing within the Salesforce sandbox environment.

Rather than validating individual components independently, Ennovision tested three complete authentication scenarios, allowing the team to assess the behaviour of the overall journey from authentication through provisioning and onward navigation.

Testing covered the interaction between:

External authentication → Salesforce authentication handling → JIT provisioning → access assignment → Experience Cloud → post-login redirection.

Issues identified during testing were remediated before production deployment.

Ennovision also produced dedicated UAT documentation defining acceptance criteria and success measures for the SSO journey, giving the customer a structured basis for validating the solution.

Controlled Production Deployment

Production deployment involved more than simply migrating Apex code.

Ennovision prepared the relevant Change Sets/DevOps deployment components, including code, metadata and Experience Cloud site components.

Post-deployment activities included activating the authentication provider within the live environment, updating callback URLs in the external system and completing final smoke testing.

This ensured that environment-specific authentication dependencies were addressed as part of the production release.

Documentation and Knowledge Transfer

A detailed administrator handover guide was produced to ensure that the solution could be operated and maintained after implementation.

The documentation covered ongoing administration as well as manual and post-deployment configuration requirements.

This was particularly important for an authentication solution because some elements of the configuration sit outside deployable Salesforce code and metadata and therefore require clear operational procedures.

The Outcome

The engagement delivered the engineering foundation for a more scalable authentication and user-management model within Salesforce Experience Cloud.

Instead of treating SSO as simply a login mechanism, the solution connected identity, automated provisioning, Salesforce security and the digital user journey.

The resulting architecture provided the customer with:

• Automated user onboarding through Just-in-Time provisioning, reducing dependency on manual Salesforce administration.
• A smoother Experience Cloud journey, including controlled login behaviour and post-authentication deep-linking.
• Stronger data integrity, with validation built into automated record creation.
• Production-grade exception handling for scenarios such as duplicate identities and external API failures.
• Controlled Salesforce access, incorporating site permissions, profile configuration and Field-Level Security.
• Greater deployment confidence, through Apex unit tests, end-to-end sandbox testing, documented UAT criteria and production smoke testing.
• Improved maintainability, supported by comprehensive administrator and post-deployment documentation.

Ennovision’s Role

The engagement demonstrates the role Ennovision can play as an engineering partner to Salesforce consultancies and implementation partners.

The client retained ownership of its customer relationship and overall Salesforce delivery, while Ennovision provided the specialist engineering capability required to design, build, test and deploy the technical solution.

This model allows Salesforce partners to access deeper technical capability for individual projects without having to maintain every specialist skill permanently within their own teams.

From Salesforce Configuration to Salesforce Engineering

Many Salesforce requirements can be delivered through configuration.

The more challenging projects begin when Salesforce must interact with external identity platforms, APIs, custom provisioning rules, security models and customer-facing digital experiences.

That is where engineering capability becomes increasingly important.

For this engagement, Ennovision combined Apex development, authentication architecture, Just-in-Time provisioning, Experience Cloud configuration, security, automated testing and DevOps to turn an authentication requirement into a production-ready Salesforce solution.

Ennovision Technology Solutions — engineering the complex parts of Salesforce delivery.