title: Identity Server Resource Owner flow with external Identity Provider
body: <p>We have a project where the client requests the use of their own Identity Provider, in this case, it is SalesForce.</p>
  <p>We secure the application using IdentityServer 3 and have configured it that for this client (based on parameters) it will use SalesForce as the IDP.</p>
  <p>For the web app, no problem, Identity Server redirects to the Sales Force login page and everything works great.</p>
  <p>Now we have a mobile app to build and the client would like to avoid having a web login page and would rather have a nice polished login form built in the application. This means that we will have to use the Resource Owner flow.</p>
  <p>Now, the users creds are on SalesForce side so how does that work and is this at all possible in IdentityServer 3 ?</p>
  <p>I see 2 possibilities but I kind of like neither of them:</p>
  <ol>
  <li><p>Send the auth call to IdentityServer which should detect that it is up to SalesForce to validate the user and forwards the request there.<br/> I think it is not good as I would rather avoid having my IdentityServer dealing with credentials that he should not even know</p>
  </li>
  <li><p>Send a first auth call to SalesForce to get some &quot;id token&quot; that would then allow me to send another auth call to IdentityServer which will then recognize the &quot;id token&quot; and release an access token.<br/>
  That seems like a stretch and forces the app to know that there is an IDP which is none of its business.</p>
  </li>
  </ol>
  <p>Any idea?</p>