3

I am going to build a native Salesforce app (Managed package) that will be installed in many subscriber orgs.

The app will make callouts (eg. calling REST endpoint) to external Java app. The Java app will then use Standard Salesforce APIs (SOAP or REST) to modify Accounts records on behalf of the user in the subscriber org.

What is the recommended way to do this? It needs to be:

  • secure: Respect the Salesforce permissions of the user. Not use "single point of failure" integration user for the API access back to Salesforce. It needs to pass Security Review without any doubt ;-)
  • minimize manual work: User should not have to constantly log into both system. User information should also not be mirrored in the Java app.
  • lean: The fewer code and complex configuration is needed the better.

adas

Improve this question
4
  • 4
    Will the callouts and record edits only happen while the user is using Salesforce interactively?
    – Thomas Taylor
    Commented Jun 27, 2019 at 14:45
  • 2
    Send user's encrypted SessionId in rest callout to the java app?
    – Pranay Jaiswal
    Commented Jun 27, 2019 at 15:40
  • @ThomasTaylor yes
    – Robert Sösemann
    Commented Jun 27, 2019 at 15:56
  • 1
    Why not have the external Java Web App return the detail of the update it would like to make and have the Apex actually do the update. That way it runs in the same user's context and you can therefore apply relevant permissions.Your Java can return multiple different types of object to be updated. You can do a single Database.update with a heterogeneous list of objects (it's just upsert that can't handle this IIRC).
    – Phil W
    Commented Jun 27, 2019 at 16:23

2 Answers 2

Reset to default
4

oAuth was designed for this use case and SF supports many oAuth flows. If you want to avoid using a service account (aka integration user), then pick a flow where user has to authorize access. From there you're in a standard oAuth refresh + access token management lifecycle, the user doesn't have to be logged in.

When you implement oAuth, there are quite a few security nuances. Thankfully all of the hard work has been done for you, you just have to carefully read the docs and translate them into code ;-)

IETF - Best Practices

  1. oAuth 2.0 for native apps (BCP 212, Oct 2017)
  2. oAuth 2.0 Security Best Practices (draft 12, Mar 2019)
  3. oAuth 2.0 for Browser-Based Apps (draft 01, Mar 2019)

For example, if your Java app is a browser-based app, the recommendation from the best practices doc is to use authorization code flow with PKCE extension. In Salesforce world this translates to Web Server Authentication flow

Improve this answer
0

If you have control over the java web app, Canvas app and a Connected app distributed in a managed package is your solution. An admin can pre-approve the app and the java app will need to decode a signed request, get context, extract session Id and consume the rest Api broker.

Your java web app now can interact directly with Salesforce REST API.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .