The flow can be invoked from a user-facing process. Here are the parameters:
/services/auth/xds/{org_id}/{authprovider_developer_name}- this issues the logout,&startURL=/0XA...- this ID tells SF which Named Credential to link the grant against,&scope=full...- list of scopes/privileges presented to the user at the Allow screen,
Apex code to return such a URL from a VF page action or button:
public PageReference authorizeNamedCredential(String authProvider, String namedCredential)
{
AuthProvider provider = [
SELECT Id
FROM AuthProvider
WHERE DeveloperName = :authProvider
];
NamedCredential credential = [
SELECT Id
FROM NamedCredential
WHERE DeveloperName = :namedCredential
];
String oid = UserInfo.getOrganizationId();
String domain = Url.getOrgDomainUrl().toExternalForm();
String path = '/services/auth/xds/' + oid + '/' + authProvider;
String startUrl = '/' + String.valueOf(credential.Id).left(15);
PageReference redirect = new PageReference(domain + path);
redirect.getParameters().put('startURL', startUrl);
redirect.getParameters().put('scope', 'full refresh_token');
return redirect;
}
After logging back in, the user must manually click Allow:
Technically it's possible to skip the manual authorization nag by pre-authorizing the app on a Profile or Permission Set. But the pre-authorization step is itself a manual process!
- Deploy the Connected App into the org per your Metadata API
- Go to Setup > Connected Apps > Manage Apps > Edit Policies
- Change "Permitted Users" to "Admin approved users are pre-authorized" then save
- Edit the Profiles or Permission Sets then navigate to Connected App Access
- Enable the app, then save.