OAuth 2.0 (or similar) without security token

Question

This article about oAuth 2.0 says , that user must provide security token to log in. Can i somehow disable usage of security tokens? I don't want my users to perform unnecessary operation.

Or may be there is some alternative way to find out , if user's login\password are valid in salesforce

My code to authorize (may be there is another issue why i have an error like

{"error_description":"expired access/refresh token","error":"invalid_grant"} )

    private const string ClientId = "3MVG9A2kN3Bn17huRprJBCInrodPdsyHERlP1nUDPXnApOiQURGxtr9pxl...."; // Consumer Key from SFDC account
    private const string ClientSecret = "43802039754906815..."; // Consumer Secret from SFDC account
    private const string RedirectUrl = "https://localhost:8443/...."; // Redirect URL configured in SFDC account
    private const string  SfOAuthUrl = "https://login.salesforce.com/services/oauth2/token";

public static void AuthenticateToSalesforce()
    {
        var username = "[email protected]";
        var password = "MyPassword_Without_Security toke";

        var parameters = "grant_type=password"
                                  + "&client_id=" + ClientId
                                  + "&client_secret=" + ClientSecret
                                  + "&redirect_uri=" + RedirectUrl
                                  + "&username=" + username
                                  + "&password=" + password;

        var result = HttpPost(@SfOAuthUrl, @parameters);
    }

    public static string HttpPost(string URI, string Parameters)
    {
        var req = WebRequest.Create(URI);
        req.ContentType = "application/x-www-form-urlencoded";
        req.Method = "POST";

        var data = Encoding.ASCII.GetBytes(Parameters);
        req.ContentLength = data.Length;
        var os = req.GetRequestStream();
        os.Write(data, 0, data.Length);
        os.Close();

        try
        {
            var resp = req.GetResponse();
            var sr = new StreamReader(resp.GetResponseStream());
            return sr.ReadToEnd().Trim();
        }
        catch (WebException ex)
        {
            var resp = new StreamReader(ex.Response.GetResponseStream()).ReadToEnd();
            Console.WriteLine(resp);
        }
        return string.Empty;
    }

I've also set the range of trusted IPs which, according to the article, should disable usage of security tokens, but error is still the same

Answer 1

Security Tokens are not required from Trusted IP addresses.

You can make a single range of IP address 'trusted' in Setup > Security Controls > Network Access.

You can blat out multiple ranges like 0.0.0.0 to 255.255.255.255 (not recommended) on a Profile too.

Keith C's commentary is well placed; holding user credentials (and security token) may be a red flag.

Answer 2

The token's only required if you use user/pass flow, which is not recommended for normal, production-ready OAuth2 implementations (it's the same as trying to make a SOAP login() call). Instead, use the user-client flow, which follows the normal Identity Confirmation flow (e.g. a SMS or email verification code). In C#, for example, you can use a WebBrowser control to present the OAuth2 login. If the user's default browser is Internet Explorer, and they are already logged in through another window, and they've already granted access, the login will complete automatically with no interaction from the user at all.