I want to expose my API to an external system, and I want to authenticate the user by only username and password. I don't want to use username password OAuth flow while authenticating the user. Can we achieve this?
You can achieve this with User-Agent OAuth flow. On a very high level, you have to follow these steps to create one.
- In your Salesforce Org create your own REST API.
- Create a Connected App and note down the ClientID and ClientSecret.
- Now to call this REST API you have to first get the access token. To
get this token you have to call this URL via POST Method
https://login.salesforce.com/services/oauth2/token. Based on the type of org use
grant_type=passwordfor User-Agent OAuth flow. So your request body should look like this
- You will get a JSON response. Get the access token by parsing the JSON.
Next call your REST API and set this
'Authorization','Bearer ' + accessTokenin the Authorization Header.
And you will get your Response.
It's not REST based, but you can use the SOAP Partner API to establish a valid Session using the Username and Password. You will likely also need to append the Security Token to the end of the Password depending on how the org is setup.