<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeKnowledge Base

Pass Dynamic Authentication Context For Custom Salesforce Applications In Okta

Last Updated:

Okta Integration Network
Okta Identity Engine

Overview

Custom Salesforce applications do not send Authentication Method Reference (AMR) claims by default, which causes authentication compliance issues. Configuring the custom Salesforce SAML application to send the session.amr value resolves the issue. If Salesforce fails to recognize the default comma-separated format and prompts administrators to enroll in a passkey, sending the values as a semicolon-separated string resolves the secondary issue.

Applies To

  • Okta Identity Engine (OIE)
  • Okta Classic Engine
  • Custom Salesforce Application
  • Single Sign-On (SSO)
  • Multi-Factor Authentication (MFA)
  • Okta Integration Network (OIN)

Cause

Custom Salesforce applications do not send AMR claims by default, unlike applications created from the Okta Integration Network (OIN) catalog.

Solution

What steps configure the standard Dynamic Authentication Context for Salesforce?

Configure the custom Salesforce SAML application in Okta to send the standard AMR values by adding a new attribute statement.

  1. Navigate to the Okta Admin Console.
  2. Choose Applications > Applications.
  3. Select the custom Salesforce application.
  4. Select the Sign On tab and choose Edit.
  5. Add a new attribute in the Attributes (Optional) section with the following configuration:
    • Name: amr
    • Name Format: Unspecified
    • Value: session.amr
  6. Select Save.

 

What steps resolve the comma-separated format issue for Salesforce?

If Salesforce prompts administrators to enroll in a passkey because it does not recognize the comma-separated format, configure the attribute to send the AMR values as a semicolon-separated string.

  1. Navigate to the Okta Admin Console.
  2. Choose Applications > Applications.
  3. Select the custom Salesforce application.
  4. Select the Sign On tab and choose Edit.
  5. Add or modify the attribute in the Attributes (Optional) section with the following configuration:
    • Name: amr
    • Name Format: Unspecified
    • Value: String.join(";", session.amr)
  6. Select Save.

 

Related References

Recommended content

Still looking for help?
Loading
Okta Support - Pass Dynamic Authentication Context For Custom Salesforce Applications In Okta