We use a connected (canvas) app to integrate a third-party web application in salesforce. We use the the 'signed request' authentication model and it works as expected. If the connected app is configured as 'Admin approved users are pre-authorized' the canvas URL will be called with a HTTP POST request containing the signed_request object in the body.
Nevertheless, if we install the app via a managed package in an organization where API whitelisting is enabled, the connected app UI show that the app is configured as 'Admin approved users are pre-authorized' (default behavior when API whitelisting is enabled - all connected apps are forced to the 'Admin approved users are pre-authorized' setting).
The problem is that in this organizations still a HTTP GET request (_sfdc_canvas_authvalue=user_approval_required) is send to the canvas URL although the connected app is forced to the 'Admin approved users are pre-authorized' setting (forced because of the API whitelisting).
The only workaround to get the connected app working in organizations that use API whitelisting, is to disable API whitelisting temporarily after the package installation and then manual set the connected app to 'Admin approved users are pre-authorized'. Afterwards the API whitelisting can be enabled again and the 'signed request' authentication model works as expected.
Anyone experienced this behavior or have an advice how to fix this? I can't imagine that this is the expected behavior and i don't like the fact that customers are forced to temporarily disable API whitelisting in a production environment.