Create an Interview-Based Login Page with My Domain Login Discovery

Configure My Domain with Login Discovery to simplify the login process for users. Login Discovery is sometimes called interview-based login because it’s a two-step process. First, users identify themselves with an email address or phone number at the login page. Next, users verify themselves depending on the identifier entered. Users can verify themselves with a password, their SSO credentials, or Lightning Login. You set up Login Discovery from the My Domain Setup page after you create an Apex class that implements the MyDomainLoginDiscoveryHandler interface.

Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience

Available in: Group, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer Editions

User Permissions Needed
To customize a My Domain login page:	Customize Application

My Domain Login Discovery requires that My Domain is set up for your org. If you’ve already set up My Domain, you can migrate users to the Login Discovery login process.

Note

Login Discovery eliminates the onerous task of managing forgotten usernames. With Login Discovery, your users can log in with something they are likely to remember, like their email address or phone number. Also, if your org is configured with multiple identity providers (IdP) for SSO, Login Discovery can direct users to the suitable IdP. If your login page contains an SSO button along with the username and password fields, users can miss the button or not know what it’s used for. If you’re using Login Discovery, no decisions are required.

Login Discovery is helpful when you have different login processes depending on the situation, such location or device type. For example, if you have separate IdPs for mobile and desktop users. Instead of having a login page with buttons for both, Login Discovery determines where users are logging in from and directs them to the suitable IdP.

To configure Login Discovery for My Domain, create a handler in Apex and then reference the handler from the My Domain Setup page. The Apex class implements the MyDomainLoginDiscoveryHandler interface. The handler includes logic that defines how to look up a user based on the identifier value entered on the login page. Then it determines which authentication service to invoke.

Authentication configuration settings apply to all your org’s deployed and provisioned My Domains.

Note

From Setup, in the Quick Find box, enter My Domain, and then select My Domain.
Under Authentication Configuration, click Edit.
For Login Page Type, select Discovery.
Optionally, for Login Prompt, enter the text or custom label.
For example, you can use a custom label to localize the text, for example, $Login.loginPrompt.
Locate the Login Discovery Handler that you created by implementing the MyDomainLoginDiscoveryHandler interface. From Setup, in the Quick Find box, enter Apex Classes, and then select Apex Classes. Select the handler from the list.
Optionally, for Execute Login As, choose a Salesforce admin with Manage Users permission.
By default, the handler runs in system mode.
Save your changes.

If you can’t log in after setting up Login Discovery, modify the URL to return to the standard login page, which prompts for a username and password. You can add login as a URL query string parameter, for example, https://MyDomainName.my.salesforce.com/?login. Or you can add login=true to the URL, for example, https://MyDomainName.my.salesforce.com/?login=true.

Tip

Identity Implementation Guide

Create an Interview-Based Login Page with My Domain Login Discovery