I've a web app which is protected via a login mechanism. There is requirement that we need to let some users login using their Salesforce credentials instead of creating accounts at the web application itself.

For this, plan is to use OpenID Connect and use the Salesforce as an Identity provider, and login users to web site.

I've created Connected App with OAuth 2.0 settings enabled, and got Consumer Key/Secret pair to be used in the process.

Process works smoothly, and I can get the authorization code/access token, and use UserInfo end point to retrieve user details as well.

However, the problem is I can login with any Salesforce user account in any organization, not limited to the organization where I created the ConnectedApp, and I receive a callback with the details related to that particular user. I need to ensure that only the users belonging to the organization where the ConnectedApp resides.

Perhaps I've not properly understood how ConnectedApps are intended to be used?

Of course I can perform an additional check with the Organization ID, and reject a login if ID is not the expected one. But is that how it's supposed to be done?

Shouldn't using the ConsumerKey, limit the user scope to the organization where the ConnectedApp is defined?

  • how are you able to login to another salesforce orgs, if there is not connected app available for your web site in these other orgs?? Jan 12 '17 at 4:54

There could be some other simple way to achieve this but i think one possible way could be by extending ConnectedAppPlugin class.Here you can restrict access.See below image where you can provide this extended class.This option is available on connected app.

enter image description here

See this link for more info: ConnectedAppPlugin Class

  • Thank you Frodo, but that'll require me to distribute that class either through a package, or in source code form, both are not ideal options for me. Do you know if this is how ConnectedApps are expected to behave in relation to OpenID Connect?
    – BuddhiP
    May 3 '16 at 3:47
  • @BuddhiP i tried to understand your issue and i'm also confused a little. So searching for something definite. Please share if you have resolved this issue.
    – Mr.Frodo
    May 3 '16 at 16:55
  • Thank you for your followup. I've logged a case with SF dev support, let's see what they'd say.
    – BuddhiP
    May 4 '16 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.