Tie web server oauth to user session in my canvas app

Question

I'm trying to figure out how to allow my users to login to my app using only Salesforce. I think I want to use the "web server oauth flow" and follow the directions in the solution here:

https://stackoverflow.com/questions/32002126/salesforce-canvas-app-oauth-web-server-flow-with-minimal-user-interaction

Namely this part where he says:

You can fire off immediate = true request, and right after it immediate = false in case first one failed. Then you send the access_token to your app by creating third request – to your own server.

He says the result of both of those calls (either immediate=false or immediate=true) will generate an access_token which I can send to my own server. But how do I tie this to a user account in my own database? Like, say if he's logged in before and so I already have an email address joe@gmail.com in my database and I receive a web request to my redirect_url callback with an access_token (which happens to belong to Joe) - how can I know it belongs to joe@gmail.com and I can grant the user a "Joe" session in my app?

Alternatively, if it's a new user account, how do I detect that and pull their user information from Salesforce (name, email address) so I can create a user account in my database, and grant them a valid session in my app?

Answer 1

This question is, effectively, asking the difference between authorization and authentication.

OAuth 2.0 is an authorization standard. The access token you receive from the server authorizes you to make requests against the server (in this case, the Salesforce API) and access specific resources without having to store the user's credentials.

You declare what resources you want to access in the scopes parameter of your authorization request. You can learn about the scopes available in the docs, but I recommend this blog post: Digging Deeper into OAuth 2.0 on Force.com .

So, what's authentication and what does that have to do with the above? Authentication refers to when the server (again, the Salesforce API) tells you who the actual user is without you having to store their credentials. Authentication is important when you want to use the Salesforce API as an Identity Provider -- where your app grants sessions based on their Salesforce identity.

In order to accomplish that, you have two options. The "old school"/simple way is just to request the id scope with your OAuth request. You can then make a request against the Identity Service to receive the user's email address, username, name, and any custom Connected App attributes.

The emergent standard however is to use OpenID Connect, by requesting the openid scope and validating the JWT that's returned.