2

The question is a bit of a mouthful. This has to do with the various Salesforce APIs - I want to try to use the web server flow as it will mostly be service to Salesforce communication that happens automatically. My question is - if a particular user is the one who initially authenticates - how tied is the authentication to that user?

Meaning, if that user changes their password or has their account closed - will that affect the service's access token?

I guess the heart of this question is - what is the best way to authenticate a 3rd party service with an org for automated communication? I'd prefer it not be tied to specific users if possible.

  • Is it that you need something like rails app deployed to heroku which communicates with sobjects using the rest api after getting the access tokens from the browser.If the developer uses the yaml file for authentication then he is doomed to be tied to a specific user else he can use oauth.Honestly i, didn't get your question properly.So sorry for spam if any. – user477 Sep 22 '12 at 20:51
  • What is the underlying use case here? Does the web server app always operate on data in the context of the user on the other end of the wire, or can it operate independently of the user? – metadaddy Sep 23 '12 at 22:05
  • It's independent of the user - at least, I don't need to depend on the user. I don't think SFDC let's you really do things independent of a user though so maybe that answers the question. All I need to do is read data out periodically. An example use case would be syncing data from SFDC out to a 3rd party system where the sync has to originate outside of SFDC. – Ryan Elkins Sep 24 '12 at 3:33
3

All access to the Force.com APIs is in the context of a user, so you should create an 'integration user' with the least amount of privilege necessary for the task at hand (for example, you can set the user as 'API only'). Depending on which API (SOAP or REST) you're planning on using, your app should authenticate with the integration user's credentials using either the SOAP login() or OAuth Username/Password flow to get a session ID (aka access token) with which you can call APIs.

Since you will be storing credentials for the integration user, follow best practice and don't write them into source code - keep them instead in environment variables or similar configuration.

Lastly, you will need to balance the convenience of getting a new session ID/access token for each interaction with Force.com (at the cost of an additional round-trip to login.salesforce.com) versus the complexity of dealing with an exception arising from an expired session if you decide to keep the token around.

  • Pat, what about the PHP API is there a way around storing username and password/security token in the code and remembering to update the code when the user changes their password (yes larger organisations can justify an API only user with a profile that has the permission: 'Password Never Expires' but we all know that small organisations can't justify this additional licence cost)? – Jason Lawrence Sep 24 '12 at 6:26
  • I thought about this, the main issue being that it is expensive to have a dedicated license for API usage. I think this is probably the best option SFDC offers right now though. – Ryan Elkins Sep 24 '12 at 14:05
  • @JasonLawrence You can pull env vars into PHP scripts - I do this all the time: define("CLIENT_ID", getenv("CLIENT_ID"));. One way to set them is via the Apache config - see this answer over at StackOverflow. – metadaddy Sep 24 '12 at 18:57
  • @metadaddy : Is there any specific reason to use OAuth Username/Password flow and not OAuth Webserver flow ? Is OAuth Webserver flow possible between two salesforce Orgs? – Vignesh Jul 1 '14 at 6:22
  • You can do OAuth web server flow between two orgs (actually, it's better to use the Salesforce auth provider, since this automates the flow), but the question was about an automated communication, so there would be no user around to 'drive' the flow. – metadaddy Jul 1 '14 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.