3

I hoping to get some best practice related to using a consumer key with a native iOS app and Salesforce.com.

The following is relevant to this scenario:

  1. A Managed Package (MP) has been created and completed security review
  2. The MP has a connected app that has been white-listed by Salesforce.com
  3. A native iOS app has been created the uses OAuth 2.0 - User-Agent Flow
  4. The native app does not require the manage package to operate, thus only a subset of customers actually have the MP installed in their Salesforce.com org

Now to my question:

What would be the best practice way of determining when a customer has installed the MP and/or when to append the consumer key (client_id) in the OAuth flow to ensure that subsequent calls to the REST API can be completed (Specifically for Professional/Group editions)?

  • Professional/Group editions do not have API enable by default. So how can you use it? – AtulRajguru9 Feb 2 '16 at 10:38
  • 1
    Use the key all the time, the MP doesn't have to be installed for it to work. – superfell Feb 3 '16 at 0:42
  • We seem to be getting invalid scope errors when we use the key without the managed package installed. Thoughts? – techbusinessman Feb 3 '16 at 14:04
  • I think you might be mixing up a few different things here. A consumer/client ID uniquely identifies your OAuth app and must always be specified. A partner token is specifically what enables API usage in GE/PE orgs, and must always be specified (if you have one). Neither of these require the managed package being installed. – Jonathan Hersh Feb 4 '16 at 3:08
  • So supplying the clientid seems to work regardless of package install or not which is great. My understanding is that SFDC whitelists the connected app in a MP so that upon package install you can use the rest API, is this incorrect? – techbusinessman Feb 4 '16 at 3:14
2
+50

I think you are misreading the documentation. Installing a package, managed or otherwise, has nothing to do with accessing the API in GE/PE orgs. Instead, as you've already discovered:

I'm not fully understanding because I provided all the details of the connected app to partner support including the clientid and secret and support closed the case and told me that the connected app was whitelisted. I assumed that meant that as long as our mobile app authenticates with the clientid and secret, it could access the REST API in GE/PE.

That's it, you're done. Your OAuth application's client ID and secret key are already whitelisted for GE/PE orgs, so you need only log into a GE/PE org using an OAuth app that specifies those keys. Then your app will have API access.

My understanding is that SFDC whitelists the connected app in a MP so that upon package install you can use the rest API, is this incorrect?

This is incorrect, and additionally, your connected app ought not be part of the package definition.

What would be the best practice way of determining when a customer has installed the MP

Depends on your package. You could issue a global object describe and check for the presence of a custom object or setting included with your package, or you could issue a SOQL or SOSL query for an object that's included with your package. The results will tell you whether your package is installed.

and/or when to append the consumer key (client_id) in the OAuth flow to ensure that subsequent calls to the REST API can be completed (Specifically for Professional/Group editions)?

Every API call must always include your client ID and secret. This is how you identify to the server which OAuth app your native app is using. Again, it is irrelevant whether your package is installed in the org for the purposes of accessing the API.

  • Hi Jonathan. This helps me tremendously!! I was under the impression the app had to be installed for the whitelist to work. Thank you so much for helping me out here. – techbusinessman Feb 8 '16 at 22:48
0

After installation of Managed Package you will receive an email with user ID, org Id and package Id. You can store org id to determine if MP was installed and user is allowed to use your app. You should use client id and consumer secret for granting access/refresh token only. For calls to SF api you need to use access token. If it expired use refresh token

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.