Passing Client Id and Client Secret in URL as Encrypted String for AppExchange App

Question

We are developing an AppExchange application which integrates with external application .Every customer has a connected app because of different branding and different and different callback URLs. Currently to make a connection from external system to Salesforce Customer Admin needs to copy client Id and client Secret in external application and save in the external application. To make user interface simple we want to following:-

1. Customer Admin User to configure connected app.
2. In the Appexchange application config wizard enter the client id , client secret and redirection URL and click on Login to External system button.
3. On click of the button Client Id, Client Secret and Redirection URL will be passed to external website in an Encrypted format.
4. User will login to external system and then for that external application the Client ID, Client Secret and Callback URL will be stored in External System.
5. Then external application will redirect user to the Salesforce URL to Authenticate the access using connected app.
6. After successful authentication and once system admin allows the access, the refresh token/access token returned from Salesforce will be stored in External System.

Question: To makes configuration steps easy, we will need to pass the Client ID, Client Secret and Callback URL in Encrypted format to external system. The Encryption key will be stored in a Protected Custom Metadata, which can be same for all customers to reduce the configuration steps. From security review perspective, is it a secure approach to pass encrypted ClientID, Client Secret and call back URL in the URL?

Answer 1

It is generally not in the spirit of OAuth to be passing the client secret around as this is supposed to authenticate the client. But whether your system is exploitable depends on what you are doing.

1. You say the client secret is encrypted -- how? And how is key management handled, and how is that wrapping key stored and distributed?

2. How are you authenticating the external system that you are passing the client secret to?

3. Why don't you just have a client secret for the external system itself?

I suspect you are doing something that is unnecessary here.