1. Identity and Access Management Designer
1.1. Exam outline
1.1.1. Identity Management Concepts 34% (20 questions)
1.1.1.1. Describe the risks to enterprise security that federated single sign-on solutions aim to address.
1.1.1.1.1. Single sign-on (SSO) is a session and user authentication service that permits a user to use one set of login credentials (e.g., name and password) to access multiple applications
1.1.1.1.2. Having multiple credentials also increases the complexity of how each application would present users with different sign-on displays. This situation exposes an underlying deeper issue: the users would be very susceptible to phishing attacks because it increases the sign-on methods that could be spoofed. This situation reinforces a need for allowing users access to applications using Single Sign-On (SSO) as one source of authentication in today’s world where applications are increasingly becoming disjointed from being hosted on premise to the cloud.
1.1.1.1.3. Authentication (passport - IdP
1.1.1.1.4. Authorization (boarding Pass - token)
1.1.1.2. Describe the role(s) an identity provider and service provider play in an access control solution.
1.1.1.2.1. Identity Provider
1.1.1.2.2. Service Provider
1.1.1.3. Describe common methods how trust connections are established between two systems and the methodologies used to describe trust between an identity provider and service provider.
1.1.1.3.1. Session Level Policies
1.1.1.3.2. 2 Factor Authorization - riskbased
1.1.1.3.3. Methods of trust
1.1.1.3.4. Methodologies
1.1.1.4. Given a scenario, articulate whether it is describing an authentication, authorization, or accounting scenario and what Salesforce feature should be used to accomplish the task.
1.1.1.4.1. Understanding OAuth 2.0
1.1.1.4.2. Digging Deeper into OAuth
1.1.1.4.3. Authentication
1.1.1.4.4. Authorization
1.1.1.5. Given a scenario, recommend the appropriate method for provisioning users in Salesforce and other third party services (SOAP/REST API, SAML JIT, Identity Connect, User Provisioning for Connected Apps, etc.)
1.1.1.5.1. Identity Connect
1.1.1.5.2. SOAP/REST API
1.1.1.5.3. SAML JIT
1.1.1.5.4. User Provisioning for Connected Apps
1.1.1.6. Given a scenario, troubleshoot common points of failure that may be encountered in a single sign-on solution (SAML, OAuth, etc.).
1.1.1.6.1. Check login History
1.1.1.6.2. SAML Assertion Validator
1.1.1.6.3. Browser add-on: Live HTTP Headers
1.1.1.6.4. What fields can the SAML assertions have for the user?
1.1.1.6.5. Why would you get an Assertion Expiration?
1.1.2. Accepting 3rd party Identity 21% (13 questions)
1.1.2.1. Describe the components of an identity management solution where Salesforce is accepting identity from a 3rd party.
1.1.2.2. Given a scenario, recommend the appropriate authentication mechanism when Salesforce needs to accept 3rd Party Identity (Enterprise Directory, Social, Community, etc.)
1.1.2.3. Given a scenario, recommend the appropriate method of SAML initiation to fulfill the requirements (SP-init, IdP-init.)
1.1.2.4. Describe the components of a Delegated Authentication solution.
1.1.2.4.1. Managed at the permission level, allowing flexibility to require some users to delegate authentication while others SFDC managed.
1.1.2.4.2. SFDC validates username and checks users permission and access settings
1.1.2.4.3. IF SSO enabled permission for user then makes a call to the webservice to Authenticate. If enabled then SFDC no longer manages/enforces password policies
1.1.2.4.4. Web Service passes the Uname, Pwd and source IP. Service returns "True" or "False" to Salesforce.
1.1.2.5. Describe the risks of implementing delegated authentication.
1.1.3. SFDC as an identity provider 18% (11 Questions)
1.1.3.1. Given a scenario, determine the most appropriate flow type to recommend when implementing an OAuth solution where Salesforce is providing identity to a 3rd party (E.g. User Agent, Web Server, JWT, etc.)
1.1.3.1.1. Web server (Authorization Code) Gold Standard when the client can securly keep the secrete. Utilizes refresh token. Normally for Server to Server web communications
1.1.3.1.2. User Agent (Implicit) - Normally used for mobile clients - can utilize the refresh token
1.1.3.1.3. User Name and Password (Resource owner and password) Shouldn't be used only as last resource since this passes the Username and Password back and forth (no refresh token)
1.1.3.1.4. Device (Client) - used by devices such as smart TVs or picture frames where they are limited input feature. (no refresh token)
1.1.3.1.5. JWT Bearer - used between server to server with a digital certificate where no resource owner is required to put in a Uname or pwd, after the initial setup. JASON based (no refresh token)
1.1.3.1.6. SAML Bearer - Same as JWT but XML based, SAML (No refresh token)
1.1.3.1.7. SAML Assertion - No connected app is required (no refresh token)
1.1.3.2. Describe the various implementation concepts of OAuth (E.g. scopes, secrets, tokens, refresh tokens, token expiration, token revocation, etc.)
1.1.3.3. Describe the role(s) Connected Apps play when Salesforce needs to provide identity to a third party system.
1.1.3.3.1. Connected App Key Settings
1.1.3.4. Given a scenario, recommend the Salesforce technologies that should be used to provide identity to the 3rd party system. (Canvas, Connected Apps, App Launcher, etc.).
1.1.4. Access Management Best Practices 12% ( 7 questions)
1.1.4.1. Describe the risks that Two-Factor Authentication mechanisms aim to mitigate.
1.1.4.2. Given a scenario, determine the most appropriate Two-Factor Authentication mechanism for an identity solution.
1.1.4.3. Given a scenario, identify the risks and mitigation strategies that session security and Two-Factor Authentication enable (E.g. High Assurance Sessions, 2FA, etc.).
1.1.4.3.1. High Assurance sessions for reports, dashboards, email adoption campaigns
1.1.4.3.2. Manage IP restrictions
1.1.4.3.3. Encryption keys
1.1.4.3.4. Manage Auth Providers
1.1.4.4. Delegated Best Practices
1.1.4.4.1. Must deploy webservice into DMZ
1.1.4.4.2. 10 seconds for login time out, user presented with error message
1.1.4.4.3. Generate SOAP stub from WSDL file, EXACT matches, includes capitalization
1.1.4.4.4. Webservice avaliable to TLS
1.1.4.4.5. IP address that originated request = SourceIP
1.1.4.4.6. Recommend NOT to enable SSO for Admins due to Authentication server has outage Admin can disable SSO for rest of company
1.1.4.5. Federated Authentication SAML Best practices
1.1.4.5.1. SSO setting configuration has the Login URL in Salesforce to be placed in the Identity provider, some time called the recipient URL
1.1.4.5.2. 3 minute time skew with IDP server
1.1.4.5.3. Use SAML assertion validator located on the SSO setting config page in Salesforce, for troubleshooting
1.1.4.5.4. Use the My Domain settings to prevent users from logging into SFDC directly.
1.1.4.5.5. audience URL must match Entity ID value in the SSO configuration.
1.1.5. SFDC Identity 8% (5 questions)
1.1.5.1. Given a scenario, recommend the most appropriate Salesforce license type(s) to support the identity requirements.
1.1.5.1.1. External Identity License
1.1.5.1.2. Identity license
1.1.5.2. Describe the role(s) Identity Connect plays in an Identity Management solution.
1.1.5.2.1. Ability to connect to Active Directory and provide near realtime sync between AD and Salesforce user, one way sync, to provision Salesforce Users.
1.1.5.2.2. Provides SSO to your orginization
1.1.5.2.3. User Provisioning only if org already has an SSO solution.
1.1.5.3. Other Identity notes
1.1.5.3.1. Deployment Considerations
1.1.5.3.2. Password Sync plugin
1.1.5.3.3. Integrated Windows Authentication (IWA)
1.1.6. Community (partner and customer) 7% (4 questions)
1.1.6.1. Describe the capabilities for customizing the registration experience for external communities (E.g. Branding options, self-registration, communications, etc.).
1.2. Journey Guide Study resources
1.2.1. Architect Core Resources
1.2.2. Trailmix: Identity and Access Management Designer Resource Guide
1.2.2.1. General Resources
1.2.2.1.1. Understanding Authentication
1.2.2.1.2. About Single Sign-On
1.2.2.1.3. Identity Implementation Guide
1.2.2.1.4. Identity How-to's
1.2.2.1.5. OAuth.net
1.2.2.1.6. Choosing an SSO Strategy: SAML vs OAuth2
1.2.2.1.7. Salesforce Identity Connect
1.2.2.2. General Overview
1.2.2.2.1. 1. SSO
1.2.2.2.2. 2. Identity Management
1.2.2.3. Suggested Activities
1.2.2.3.1. 1. Establish a Federation ID
1.2.2.3.2. 2. Set up your identity provider
1.2.2.3.3. 3. Generate SAML
1.2.3. Login Flows
1.3. Destination Success
1.3.1. Trailhead: user Authentication
1.3.2. Trailhead: Identity for Customers
1.3.3. Identity Implementation Guide
1.4. Trailheads
1.4.1. Secure Identity and Access Management
1.4.1.1. Identity Basics
1.4.1.2. User Authentication
1.4.1.3. Identity For Customers
1.4.1.4. Identity Connect Basics
1.5. Other resources
1.5.1. Succeed with Salesforce
1.5.1.1. SAML related errors and troubleshooting
1.5.1.1.1. Troubleshoot SAML Assertions
1.5.1.2. My Domain and its uses
1.5.1.3. Types of OAuth Flows (know each of them really well since there will be tons of questions on these)
1.5.1.3.1. Web Server
1.5.1.3.2. User Agent
1.5.1.3.3. Device
1.5.1.3.4. User Name Password
1.5.1.4. Two Factor Authentication (2FA)
1.5.1.5. Identity Provider and Service Provider related scenarios
1.5.1.5.1. Set up examples
1.5.1.5.2. For Salesforce to be an identity provider what needs to be enabled?
1.5.1.5.3. What would you use to troubleshoot issues when Salesforce is the Identity provider?
1.5.1.6. Delegated Authentication
1.5.1.7. SAML Federated Authentication
1.5.1.8. Community Self Registration: Apex Registration Handler related scenarios
1.5.1.8.1. What approach would be used to deprovisioning?
1.5.1.9. Login Flows
1.5.1.10. Just-in-Time Provisioning
1.5.1.10.1. What are three advantages of JIT provisioning?
1.5.1.11. Salesforce1 and SSO
1.5.1.12. External Identity, Identity, Customer Community, Customer Community Plus, Salesforce Platform licenses and uses
1.5.1.12.1. External Identity
1.5.1.12.2. Identity
1.5.1.13. CA-Signed Certificates and Self-Signed Certificates
1.5.1.14. Active Directory (AD) and Identity Connect
1.5.1.15. Connected Apps (Knowing the settings is important)
1.5.1.16. Concepts like Access Token, Refresh Token, Relay State, Start URL, Callback URL
1.5.1.16.1. Access Token
1.5.1.16.2. Refresh Token
1.5.1.16.3. Relay State
1.5.1.16.4. Start URL
1.5.1.16.5. CallBack URL
1.5.2. Video Series
1.5.3. Dzone.com
1.5.3.1. https://dzone.com/articles/saml-versus-oauth-which-one
1.5.3.2. https://dzone.com/articles/how-saml-authentication-works
1.5.3.3. https://dzone.com/articles/depth-saml
1.5.4. Provisioning Users Communities
1.5.5. Choosing an SSO Strategy
1.5.6. SFDC99
1.5.7. Which flow should I use?
1.5.8. Plurasight: Understanding Salesforce.com Single Sign-on Solution
1.5.8.1. Course Overview
1.5.8.2. Setting the Stage
1.5.8.3. Understanding Identity Provider (IdP) Initiated SAML
1.5.8.4. Understanding Service Provider (SP) Initiated SAML
1.5.8.5. Understanding OAuth Flows
1.5.8.6. Understanding Third-party Authorization Providers
1.5.9. General overview (Vinay)
1.5.9.1. What is Identity Management definition and uses
1.5.9.2. Federated identities open ID vs SAML vs OAuth
1.5.9.3. OWASP
1.5.9.4. OAuth vs. SAML vs. OpenID Connect
1.5.9.5. SAML Overview
1.5.9.6. Claims-Based Identity
1.5.9.7. Federated Identity
1.5.10. How SAML, OAuth, Identity Federation works
1.5.11. Internal Study: SFDC Bedrock
2. Integrating with the Force.com Platform
3. System Architect
3.1. Integration architecture Designer
3.1.1. Destination Success Week 1
3.1.1.1. Integrating with the force.com platform
3.1.1.2. Integration
3.1.1.2.1. Security Integration
3.1.1.2.2. User Interface Integration
3.1.1.2.3. Business logic
3.1.1.2.4. Data Integration
3.1.1.3. Trailhead: API Basics
3.1.1.3.1. Get to Know the Salesforce APIs
3.1.1.3.2. Use REST API
3.1.1.3.3. Use SOAP API
3.1.1.3.4. Use Bulk API
3.1.1.3.5. Use Streaming API
3.1.1.4. Trailhead: Apex Integration service
3.1.2. superbadge
3.1.3. SFU-Certification guide
3.1.3.1. Understanding the Basics
3.1.3.1.1. Integrating with the Force.com Platform
3.1.3.1.2. Integration
3.1.3.1.3. Integration Workbook
3.1.3.2. Integration Architecture Designer Resource Guide (Inking)
3.1.3.2.1. General
3.1.3.2.2. 1. Technologies and Overall Integration Strategy
3.1.3.2.3. 2. Integration Solution Tools
3.1.3.2.4. 3. Security
3.1.3.2.5. Suggested Activities
3.1.3.3. Prep and Study
3.1.3.3.1. Certification Study Guide
3.1.4. Independent resources
3.1.4.1. cory cowgill blog
3.1.4.2. Succeed with Salesforce
3.1.4.2.1. Items you need to know
3.2. Dev Life cycle & Deployment Designer
3.2.1. Exam
3.2.1.1. Break down...
3.2.2. Destination Success Week 2
3.2.2.1. Intro to Force.com Development Lifecycle
3.2.2.2. Intro to Application Development lifecycle
3.2.2.3. Change management
3.2.3. Unsupported Metadata types
4. Application Architect
5. Administrators
5.1. Admin
5.2. Advance admin
6. Implementation Experts
6.1. Community Cloud Consultant
6.1.1. Commitment 30-40 hours
6.1.2. Recommended Experience: 2-5 years
6.2. Marketing Cloud Consultant
6.3. Pardot Consultant
6.4. Sales Could
6.5. Service Cloud Consultant
6.6. Field Service
6.6.1. Exam Outline
6.6.1.1. Field Service Life Cycle
6.6.1.2. Explain the Salesforce product lines: Field Service Lightning
6.6.1.2.1. Allows you to manage work orders, scheduling, and mobile access.
6.6.1.2.2. Create Service Resources, and crews with skills, territories and availability
6.6.1.2.3. Multi-level territories which are regions where technicians work
6.6.1.2.4. Track: location and status of inventory, warehouse, vehicles and customer sites
6.6.1.3. Design and implement successful Field Service solutions
6.6.1.4. Build Field Service solutions that are scalable and maintainable:
6.6.1.4.1. o Scheduling and optimization
6.6.1.4.2. o Resource management
6.6.1.4.3. o Asset management
6.6.1.4.4. o Inventory management
6.6.1.4.5. o Work Order and Service Appointments lifecycle management
6.6.1.4.6. o Contract, entitlements, and warranty
6.6.1.4.7. o Mobility
6.6.1.4.8. o Quoting and invoicing
6.6.1.5. Prescribe business process optimization based on Field Service Lightning capabilities and customer needs
6.6.2. Implementing Field Service Lighting (FSL-201)
6.6.3. Complete Guide to Field Service
6.6.4. Trailhead
6.6.4.1. Getting started
6.7. Mobile Solutions Arch Designer
6.7.1. Architect Core Resources
6.7.2. App Cloud Mobile Overview
6.7.3. Lightning Experience Development
6.7.4. Mobile Solutions Architecture Guide
6.7.4.1. General Resources
6.7.4.1.1. Salesfoce1 Platform: Mobile Strategy Video Seris
6.7.4.1.2. Native, HTML5, Hybrid: Understanding Mobiel App Dev Options
6.7.4.1.3. Heroku 101: Beginner's Guide to Hosting Apps in the Cloud
6.7.4.1.4. Salesforce App Cloud API Services Guide
6.7.4.1.5. Build an IOS App on Heroku in 10 Minutes
6.7.4.1.6. Heroku Mobile App Template
6.7.4.1.7. Multi-Device Strategy
6.7.4.1.8. Power Up Your Mobile STrategy: Apps for Admins
6.7.4.1.9. From Mobile strategy to Reality
6.7.4.2. General Overview
6.7.4.2.1. 1. Mobile Strategy and Design
6.7.4.2.2. 2. Mobile Security
6.7.4.3. Suggested Activities
6.7.5. Study Guide