Is Signed Request authentication for Canvas app is enough from AppExchange Security Review perspective?

Question

I am planning to use a Canvas app for one of the AppExchange app. It will load the 3rd party page within Salesforce.

I am planning to use the Signed Request approach where the external website will implement Canvas SDK and it will authenticate the signed request.

Currently, the external site has authentication by using a username and password. As we are planning to use the signed approach, the external app will have one more way of authentication by signed request.

Question: As we are planning to use Canvas App within AppExchange with the Signed Request approach, is the signed request approach enough from a Security Review perspective or will it be mandatory to implement a single sign-on with the users of an external website? With a signed request, there will be additional validation like a valid SF user from a valid SF org is viewing the page or not.

Answer 1

You should open an office hour with the Salesforce Security Team to confirm on this.

From my experience, a Signed Request is a very valid approach and it is a secure way of authentication and been approved. Although using OAuth 2.0 layer on top of it gives benefits that users also have the ability to authorize.