How to create users for Connected App Web Server OAuth2 Authentication Flow with multiple users and tokens?

Question

I currently have one IoT device updating data on Salesforce and it is using Salesforce Connected App and the Web Server OAuth2 Authentication Flow. Currently, there is two users created:

1. Administrator user account, which is used to login to administer (create connected app and Salesforce settings) and to get a token for the IoT device.
2. A user account to just login to the front end application to see the data.

On the IoT device, to get it to connect to Salesforce Connected App I perform the following:

1. Use a third party tool, like Postman, to get an access token. Login with administrator user
2. Copy the access token, refresh token, consumer key, & consumer secret values to the IoT device.
3. Start the IoT device and have send API request to the cloud.
4. When the token expires and get "invalid session" there is source code that will automatically get a new token/refresh token.

Now, at this point this works great, but I’d like to connect many IoT device and have them upload data to Salesforce. In this case would I setup multiple accounts one for each IoT device so that a different token is used to each device and can be revoked if needed?

What is the best practices used for this type of scenario?

Answer 1

I don't really know about "Best Practice" for this scenario, but I can provide some input. Just take my advice with an appropriately sized grain of salt.

Being able to revoke access per-device sounds like a good idea, but one thing to really consider is the scale of your project here.

How many devices are you planning to support? Are you sure you will have enough licenses to support them all? How are you planning to set up the OAuth connection for individual devices?

Again, I'm not certain of the best practices for IoT, but my initial thoughts as to the approach that I might take would be:

• Set up a single User with very restricted permissions
• Require your IoT devices to provide additional identification with every request (a UUID, or Universally Unique IDentifier?)
• Do not trust the access token alone, store the additional identifier in Salesforce along with an allow/block flag
• Authenticate the content of the message the device is sending (encrypt with a private key on the device and register the public key in Salesforce? other way around?)

The basic idea is that you separate the burden of proving a device is who it says it is (and that it has permission to do things in Salesforce) from the burden of proving that it should be able to communicate with Salesforce in the first place.

Also, don't forget about how you plan to re-authenticate a device after it becomes compromised (and also how to refresh certificates, if you use them).

The last bit of advice that I'll offer is that you might want to look into the JWT Bearer OAuth flow. Most of the OAuth flows are "interactive", meaning that they require some amount of user interaction to function. Interactive flows also mean that the user of your IoT device needs to be given the login information.

I'm assuming that you're planning on giving IoT devices to customers (not for your own personal use), in which case, you probably don't want to allow your customers to access your Salesforce org and all of its data (or other people's data).

The JWT flow is (mostly) headless, which is useful for applications that don't really have a way to capture user input (such as an IoT device, unless you have the ability to modify an App to control it).