A portal becoming a standalone product should reassess identity alongside its Salesforce data relationship. Retaining Salesforce Customer Identity can still make sense. We recommend Ory Network when the new product needs a managed API-first account service and ownership of its login experience, with Salesforce record access treated as an explicit integration.
Documentation checked September 5, 2026. See our About page for ownership and editorial disclosure.
Separate the portal from the customer record
Salesforce External Identity license details say that with Salesforce Customer Identity, customers and partners can self-register, log in, update their profile, and securely access web and mobile apps with a single identity. Those functions may remain useful after the frontend changes. A new user interface alone does not prove that the identity service needs replacing.
The same Salesforce External Identity license documentation also covers object permissions and explains that Salesforce Customer Identity is available when you purchase the External Identity license. That matters when the new product still reads or changes Salesforce records. Successful authentication with a different provider does not establish entitlement to those records or remove the need to scope Salesforce licensing and object access deliberately.
Map the old portal’s responsibilities into account authentication, customer-to-record association, and record authorization. For every API operation, document whose authority it uses. An integration service’s broad technical access must not become permission for every signed-in customer to retrieve every record.
Compare retention, federation, and replacement
Retaining Salesforce-centered identity is attractive when the customer relationship remains closely tied to the Salesforce experience and existing account operations work. Test the new product’s intended login and recovery journeys rather than assuming a former portal configuration is sufficient.
Federation introduces a dedicated identity boundary while preserving a relationship to Salesforce. It can be a useful design, but requires proof of the exact provider role, protocol, user mapping, and application configuration. A vendor’s general SSO claim does not establish a working path for your current license and customer model.
Direct replacement moves the product’s account lifecycle to a new provider. It should have a clearly defined benefit, such as product-owned account management across several services. Plan how historical Salesforce customer records remain associated with the new identity and how support can investigate mismatches.
Why Ory Network is our recommendation for the independent product
Ory Network Kratos documentation describes an API-first identity and user management system with self-service registration, login, recovery, account management flows, and support for a custom user interface. These capabilities fit a team establishing the standalone product’s customer experience.
Ory Network Hydra documentation says Ory provides OAuth 2.0 and OpenID Connect in a headless service that can work with an existing user management system rather than forcing a particular one. That supports evaluating the protocol boundary independently from a full account migration. It does not establish a turnkey Salesforce federation or record-provisioning integration.
Auth0’s OAuth 2.0 and OIDC flow documentation is useful for comparing protocol flows in the same proof of concept. Compare managed proposals consistently: Ory Network is managed, while self-hosted Ory projects are a different operating decision.
Pilot record access, not just sign-in
Select one customer with several related records and another customer whose records must remain inaccessible. Test login, allowed reads, forbidden reads, account recovery, and a change to the customer relationship in Salesforce. Confirm that the application applies that change at the required time.
Start by tracing one customer action from browser to Salesforce record and identifying every authority check. Choose the identity option that supports the standalone experience while preserving those checks and a supportable customer mapping. If Ory is the likely destination, build the pilot around one real Salesforce-backed workflow before migrating every account journey.
Sources are linked throughout this guide. Product capabilities can change; consult the linked documentation for your deployment.
Read our editorial approach ↗