Notifications
Clear all
Topic starter
16/08/2026 1:12 pm
TL;DR: Modern login patterns can be supported in Salesforce Commerce Cloud through OIDC, passwordless authentication, adaptive MFA, progressive profiling, and A/B testing, though explicit registration-handler and attribute-mapping work is still required, according to Descope. The bigger identity lesson is that commerce-grade authentication is now a conversion, security, and governance problem at the same time.
NHIMG editorial — based on content published by Descope: Add Auth to Salesforce Commerce Cloud With Descope
Questions worth separating out
Q: How should teams govern customer account creation when using federated login?
A: Teams should define a single authoritative match key, restrict which claims can create a record, and require explicit handling for duplicates and renamed identities.
Q: When does passwordless authentication create new governance risk?
A: Passwordless becomes risky when organisations focus only on the happy path and ignore enrolment, device binding, fallback recovery, and support-mediated reset flows.
Q: What do security teams often get wrong about progressive profiling?
A: They often assume it is only a marketing or UX feature.
Practitioner guidance
- Define the account-matching rule before federation goes live Decide whether email, federation identifier, or another claim is the authoritative match key, and document how collisions, duplicates, and changed addresses will be handled.
- Review registration-handler logic as a lifecycle control Validate which users can be created automatically, which profile fields are writable from the identity provider, and which defaults are safe for first-time logins.
- Separate essential identity data from progressive profiling fields Classify which attributes are required for authentication, which are needed for account fulfilment, and which should be collected later after consent and purpose are clear.
What's in the full article
Descope's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step Salesforce Commerce Cloud setup for an OIDC provider and auth provider configuration.
- Apex registration-handler code for creating, looking up, and updating users during federated login.
- Flow-level examples for passwordless login, passkeys, social login, and adaptive MFA.
- Salesforce builder and workspace steps for placing the login component across storefront pages.
👉 Read Descope's Salesforce Commerce Cloud OIDC integration guide →
Salesforce Commerce Cloud auth: what IAM teams should rework?
Explore further
16/08/2026 1:14 pm
Commerce authentication is now an identity governance problem, not just a login problem. The article shows how storefront authentication has to carry account creation, update logic, and attribute mapping in the same path. That makes the integration a human IAM design issue because one login event can change the user record and the downstream session model. The practitioner takeaway is that commerce auth needs governance around account lifecycle, not just better UX.
A question worth separating out:
Q: What should IAM teams validate before allowing OIDC-based storefront login?
A: They should validate token claim mapping, user lookup logic, logout handling, and the permissions behind any automatic account creation. If those pieces are not tested together, the result can be inconsistent sessions, incorrect account updates, or users being bound to the wrong identity record.
👉 Read our full editorial: Salesforce Commerce Cloud authentication gaps and modern IAM patterns
