Auth Provider with per-user Named Credential

Question

I have a custom AuthProviderPluginClass implementation that is working fine for authorization and the related registration handler in my community for External Identity users. I've configured the NamedCredential to use the authprovider, protocol OAuth 2.0, type=Per User. After successfully logging into the community context as a user following the authentication and authorization of the external provider any attempt to access the provider's API returns this message in the logs:

EXCEPTION_THROWN|[61]|System.UnexpectedException: You don't have permission to view this data. Ask your administrator to set up authentication for the external data source.

Any ideas on how to grant permission or otherwise bypass this for the very same external data source from which the user has already authenticated and authorized?

Answer 1

You can now create an ExternalDataUserAuth record from an autolaunch flow that you call via Apex. You will need to pass in an Auth. Provider ID and a Named Credential ID to the flow to populate the AuthProviderId field and the ExternalDataSourceId field respectively. Then you can use the current user's ID to populate UserId. This saves some clicks for the users.

However this won't be authorized automatically so you will still need to send the user through the authorization flow. If they have logged into the community via the same service then they shouldn't need to enter their credentials again.

You could send them through the flow via a popup window if you have an aura component or LWC that makes the API calls. The user would need to close the window after it succeeds.

The format of the URL for an OAuth flow would be:

externalAuthUrl = URL.getSalesforceBaseUrl().toExternalForm()+'/services/auth/xds/'+provider.DeveloperName+'?startURL=%2F'+ userAuthId.left(15) +'%3Fisdtp%3Dvw';