0

I posted a question regarding rest apex security best practices.

In a nutshell I asked "how to provide partners access to our rest api". As I suspected OAuth was the recommended approach and also provide partner community access. The partner would then use their community access for OAuth and then after authentication be provided an access token and instance url.

Although, my plan was to provide the partner the OAuth Web Server flow. Since the partner will be hitting the API constantly throughout the day, don't want them to have to constantly login every time access token expires.

Should I instead provide the partner a "referesh" token?

Improve this question
2
  • Did it work for you? I am interested to know more about the use case. Let me know.
    – Salesforcesmarty
    Commented Mar 12, 2017 at 23:59
  • It did work! I did the following 1) set up partner community account, 2) use community site for access, 3) created OAuth Web Server flow, 4) gave partner refresh token. For added security, I restrict IP to partner
    – user20719
    Commented Mar 17, 2017 at 20:10

1 Answer 1

Reset to default
0

I reckon, what you are currently trying is "Username password oAuth flow" and it doesn't provide a refresh token.

There are 3 ways to authenticate user with Salesforce (Commonly used)

  • Username password oAuth authentication flow

This is a very basic flow and needs user to pass their credentials with the request each time. It doesn't provide the refresh token in the response, therefore you will need to request a new access token. However you can control this token expiry time upto 12 hours using session settings.

https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_understanding_username_password_oauth_flow.htm

  • oAuth 2.0 User agent flow

This flow is bit more secure than previous approach and doesn't need user credentials in the request. It also provides the refresh token, so you can get a new access token every time it is expired.

Additionally, this step needs user to manually authenticate and authorise Salesforce to talk to your application and will be a one time activity at the start of the application.

Only problem is that tokens are shared in the URL, instead of the response body.

https://help.salesforce.com/articleView?id=remoteaccess_oauth_user_agent_flow.htm&language=en&type=0

  • oAuth 2.0 Web server auth flow

Most common flow for authorising applications to access data in a secure manner and is being supported by most of the latest API's.

It would meet most of your requirements.

https://help.salesforce.com/articleView?id=remoteaccess_oauth_web_server_flow.htm&language=en&type=0

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .