Bypassing RemoteAccessAuthorizationPage when using a remote application?

Question

Hey guys I had a dream last night about a huge issue in our ability to aggregate data.

After setting up a remote app, using PHP to "CURL" into login.salesforce.com for authorization, we hit the Username/Password sequence. I see that this actuates frontdoor.jsp which in tern passes you to where you need to be (as long as app is accepted).

The question is how to POST through frontdoor.jsp so we will not have to manually enter a user/pass ?

I found THIS method, using http://[email protected]&pw=xxxxxxxx which works, but in order to use it, I will need to return to my script....

Without using CURL, and trying to access via

https://login.salesforce.com/services/oauth2/token?response_type=code&client_id=3MVG9A2kN3Bn17hv5JnQay9VirDF4FfYeGdVnwT0fP1AtVJoj3upT9ce7epjSmZPXsSkeX.o74fJ39Q.g9kv_&[email protected]&pw=xxxxxx&redirect_uri=https%3A%2F%2Fsm-rdc-c-dev.foo.com%2FOAuthCallback.php

give me the response error:

<OAuth>
  <error>unsupported_grant_type</error>
  <error_description>grant type not supported</error_description>
</OAuth>

POST packet looks like this.

client_id       3MVG9A2kN3Bn17hv5JnQay9VirDF4FfYeGdVnwT0fP1AtVJoj3upT9ce7epjSmZPXsSkeX.o74fJ39Q.g9kv_
pw              xxxxxxxxxxxxxx
redirect_uri    https://sm-rdc-c-dev.foo.com/OAuthCallback.php
response_type   code
un              [email protected]

Answer 1

Instead of delegating to a human for credentials, you can use the Username-Password flow (where you securely store the credentials and a security token) - here's an example:

1. Authenticate with credentials stored on your server (the response will be JSON, not frontdoor.jsp)

   $curl = curl_init();
   curl_setopt_array($curl, array(
     CURLOPT_RETURNTRANSFER => TRUE,
     CURLOPT_URL            => 'https://login.salesforce.com/services/oauth2/token',
     CURLOPT_POST           => TRUE,
     CURLOPT_POSTFIELDS     => http_build_query(array(
     'grant_type'    => 'password',
     'client_id'     => '1234567890RVOvk4UFPhxrL09VocBGAf1vMcbM8cJOZUeZ0MroSMdT...',
     'client_secret' => '1234567891234567890',
     'username'      => '[email protected]',
     'password'      => 'secret' . 'SECURITYsioWgh8yZOnUtTOKEN',
     )),
   ));
   
   $response = json_decode(curl_exec($curl));
   var_export($response);
   /*stdClass::__set_state(array(
     'id'           => 'https://login.salesforce.com/id/00Dd01234567890/005d01234567890',
     'issued_at'    => '1359399973348',
     'instance_url' => 'https://na14.salesforce.com',
     'signature'    => '1234567890cqnL8rMv9HQX7zfdo3H3Mim1234567890=',
     'access_token' => '00Dd01234567890!AR8AQFPyjVdVPp62Q2ZlM3BG0Vm33iRJs3wMWqNuJsd...',
   ));*/
   

2. Now use the Session ID to POST to your REST Web Service or whatever...

   $curl = curl_init();
   curl_setopt_array($curl, array(
     CURLOPT_RETURNTRANSFER => TRUE,
     CURLOPT_URL            => $response->instance_url . '/services/apexrest/MyController',
     CURLOPT_POST           => TRUE,
     CURLOPT_HTTPHEADER     => array('Authorization: Bearer ' . $response->access_token),
   ));
   
   $response = curl_exec($curl);
   var_export($response);
   //...