2

I'm writing a web app that prompts the user to sign in to salesforce via oauth consent so I've created a connected app in my organizations instance, and using the generated consumer key and secret key provided to do this.

It allows a user to visit the web app, visit the oauth consent screen, approve access for the web app and return with the app now having an access token.

This is good, but I realized during the OAuth process, I can sign in to any salesforce org. I tested this with another org and the process works. This is fine since I'm intending to distribute this app.

I don't understand what role the org I created the app under plays? Like I said I'm using the provided consumer key/secret keys I copied from my salesforce org from setup -> manage connected apps.

Is it ok to allow anyone to use the app? This is my intention, but I expected to have to publish the app or make it public some how.

Improve this question

1 Answer 1

Reset to default
2

Yes.

Connected Apps are essentially global metadata. They can be "installed" into specific orgs to allow admins in that org to configure policies for the app, such as preapproved Profiles and Permission Sets. However, for your external application to use the Connected App to authenticate into an org, there's no need to install in the target org. Just keep the Connected App in a single, permanent org that you own, and protect your client secret.

Improve this answer
8
  • I see. Unrelated but do you know if there is a way to add some custom fields, and some apex triggers/classes to an org during installation? My external application depends on these. If not what would I need?
    – rosghub
    Commented Aug 7, 2020 at 23:58
  • 1
    @jefferson You would want to be delivering a managed package, which the user would install outside the context of your app's OAuth flow.
    – David Reed
    Commented Aug 8, 2020 at 0:02
  • So I need to do the OAuth for an access token, and direct the user to install a managed package. Is there a way to combine what I'm doing here (getting an access token) and delivering a managed package in to one step?
    – rosghub
    Commented Aug 8, 2020 at 0:05
  • 1
    No, that would be insecure. These steps must be done separately.
    – David Reed
    Commented Aug 8, 2020 at 0:11
  • 1
    No, you don't add it to the package
    – David Reed
    Commented Aug 9, 2020 at 23:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .