Can I embed a Salesforce app, via Canvas, in another org?

Question

Here is the situation (And I am still new to this platform)... We are building a product using the Force.com Embedded (OEM) model. For clients with existing salesforce org, we would like to have seamless UI integration with the OEM product we built. Deploying in the same org is not an option due to contractual limitations.

Here are the options I can think of so far - 1. Connect the two orgs (Single Sign On), and use an iFrame to display the page in the org. 2. Use Force.com canvas

Force.com canvas is preferred as we get more integration options. However, I come across an issue using SignedRequest authentication. The signed request is not being sent to the org mainly because there is a 'redirect' in the original request, which leads to loss of the posted data. Any pointers on how to solve the issue?

Any pointers on how to do org to org integration using Force.com canvas? I haven't been able to find any resources which show a salesforce app embedded using canvas.

Answer 1

Here is a start. I'll try and flesh it out as time permits.

In the Org that will be the target of the Canvas App

1. Create an Apex Class to be the Controller. This controller will handle the processing of the signed_request POST data.
   Connected App Controller to process the Signed Request:

   public class CanvasSignedRequestController {
   
       public String signedRequest { get; set; }
       public String jsonEnvelope { get; set; }
   
       public CanvasSignedRequestController() {
           this.signedRequest = ApexPages.currentPage().getParameters().get('signed_request');
   
           if(!String.isBlank(this.signedRequest)) {
               string[] signedRequestLst = signedRequest.Split('\\.');
               System.assertEquals(2, signedRequestLst.size());
   
               // The hashed Based64 context signed with the consumer secret
               string encodedSig = signedRequestLst[0];
               Blob decodedSig = EncodingUtil.base64Decode(encodedSig);
   
               // The context and authorization token JSON encoded in Base64
               String encodedEnvelope = signedRequestLst[1];
               this.jsonEnvelope = EncodingUtil.base64Decode(encodedEnvelope).ToString();
   
               // Continue decoding - to be completed. 
               // Currently left as an exercise for the reader.
               // http://www.salesforce.com/us/developer/docs/platform_connectpre/Content/canvas_app_unsigning_code_example.htm
   
               // Use the HMAC SHA-256 algorithm to hash the Base64 encoded context and sign it using your consumer secret.
               Blob encodedEnvelopeHash = Crypto.generateDigest('SHA-256', Blob.valueOf(encodedEnvelope));
               // How do you sign this with the consumer secret using SHA-256?
               //Crypto.sign('SHA256', encodedEnvelopeHash, EncodingUtil.base64Decode(consumerSecret));
   
               //TODO: Throw an exception here if the hashes don't match. Tampered request.
   
               // Read the Session details and other useful information 
               JSONParser parser = JSON.createParser(this.jsonEnvelope);
           }
       }
   }
   

2. Create a Visualforce Page and connect to the Controller. Currently this is just to show that the signed_request has been processed.
   Very simple VF page for Site:

   <apex:page controller="CanvasSignedRequestController">
     <h1>Congratulations</h1>
     <p>signedRequest:[<apex:outputText >{!signedRequest}</apex:outputText>]</p>
     <p>jsonEnvelope:[<apex:outputText >{!jsonEnvelope}</apex:outputText>]</p>
   </apex:page>
   

3. Create a Public Site

   1. Username > Build > Develop > Sites
   2. Set the Clickjack Protection Level to "Allow framing by any page (no protection)"
   3. Add the Visualforce page to the Site Pages
   4. Change the Active Site Home Page to the Visualforce Page
   5. Activate the Site

In the Org that will be hosting the Canvas App

1. Create a Canvas App
   1. Username > App Setup > Develop > Create > Apps [New: Connected Apps]
   2. Under API (Enable OAuth Settings)
   3. Enabled OAuth Settings
   4. Callback URL: https version of the Sites URL
   5. Selected OAuth Scopes: Full access (full)
   6. Under the Canvas App Settings
   7. Check Force.com Canvas
   8. Enter the Site URL from the other Org using https
   9. Set the Access Method to Signed Request
   10. Locations: Visualforce Page

2. Create a Visualforce page to host the Canvas App.
   Visualforce page content:

   <apex:page>
       <apex:CanvasApp developerName="SitesApp"/>
   </apex:page>
   

3. Manage the Connected App

   1. Set OAuth policies to Permitted Users: Admin approved users are pre-authorized
   2. Under Managed Profiles, add System Administrators (or whichever profiles suit)

4. Preview the Visualforce Page. You should be able to see the Sites page from the first Org receiving the Signed Request Post data.