Cross-Post from developer.salesforce.com

We use a connected (canvas) app to integrate a third-party web application in salesforce. We use the the 'signed request' authentication model and it works as expected. If the connected app is configured as 'Admin approved users are pre-authorized' the canvas URL will be called with a HTTP POST request containing the signed_request object in the body.

Nevertheless, if we install the app via a managed package in an organization where API whitelisting is enabled, the connected app UI show that the app is configured as 'Admin approved users are pre-authorized' (default behavior when API whitelisting is enabled - all connected apps are forced to the 'Admin approved users are pre-authorized' setting).

The problem is that in this organizations still a HTTP GET request (_sfdc_canvas_authvalue=user_approval_required) is send to the canvas URL although the connected app is forced to the 'Admin approved users are pre-authorized' setting (forced because of the API whitelisting).

The only workaround to get the connected app working in organizations that use API whitelisting, is to disable API whitelisting temporarily after the package installation and then manual set the connected app to 'Admin approved users are pre-authorized'. Afterwards the API whitelisting can be enabled again and the 'signed request' authentication model works as expected.

Anyone experienced this behavior or have an advice how to fix this? I can't imagine that this is the expected behavior and i don't like the fact that customers are forced to temporarily disable API whitelisting in a production environment.

  • 'Admin approved users...' says the permission will be granted to the users whose profiles are in manage profile section of connected app.Have you checked this?? – Mr.Frodo Jun 20 '16 at 7:24
  • 1
    I have checked this, the permission for the connected app is set for the profile i use for testing. I think in case the connected app permission is missing, we wouldn't see a request to the cavas URL at all, because salesforce will block the usage of the app before. For me it looks like that the underlying 'self-authorization' setting is still used and not the forced 'Admin approved users...' (because a GET request is send). – lgraf Jun 20 '16 at 8:38
  • A similar post: Canvas App started sending GET instead of POST – Mr.Frodo Jun 21 '16 at 9:28
  • 1
    Thank you for the link, but the answer there only describes the behaviour of the 'self-authorization' setting. Unfortunately it gives no answer to the described problem. – lgraf Jun 22 '16 at 12:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.