Custom Auth Provider usage for unattended OAuth flow

Question

I am attempting to make a REST callout to an API in our company that uses ApiGee as the OAuth2 provider using a simple client credentials grant type. Open-ID is not enabled and will likely not be an option. The OAuth flow needs to be unattended where Salesforce would call with client id and secret to get a token and then Salesforce would make the call to the REST endpoint with that token.

It seems like creating a Named Credential is the preferred approach for REST callouts however I have been struggling to configure the Auth settings. I understand since I need a custom OAuth2 provider (without Open-ID) I need to create a Custom Authentication Provider. As mentioned above my OAuth flow needs to be an unattended client credentials. I don't understand how the 'initiate' method of my custom Auth Provider should be coded as I do not want to return a redirect page for a user to authenticate. I tried returning null, but that seemed to be problematic as it caused an internal server error when I started the OAuth flow from the Named Credentials page.

Does anyone know how to accomplish an unattended client credentials OAuth grant using Named Credentials and a Custom Auth Provider? Or if this won't work for this situation what's the next best alternative you would suggest to wire up this integration?

Answer 1

You cannot write an initiate method for a Custom Auth Provider without returning a valid PageReference object (i.e. redirect page). Salesforce configuration for Named Credential with a Custom Authentication Provider appears to be limited to the OAuth 2.0 Authorization Code Grant Type only. I don't believe that Salesforce has officially documented this key point anywhere in their documentation. If anyone has found this to be untrue, please let me know.

You do have the option to write your own code to handle a different grant type, but you'll be on your own to manage the entire authentication process/flow.

Here are a couple of references for anyone stumbling on this question in the future: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/authproviderplugin.htm

https://www.rfc-editor.org/rfc/rfc6749#section-1.3.1 - Auth Code Grant Type

P.S. Thanks for the support @Derek F!

Answer 2

OAuth Salesforce REST integration with APIGEE using grant_type=client_credentials

The purpose of grant_type=client_credentials is to hit the token URL and receive an access code with validity, so that subsequent REST API calls can be made to access resources from APIGEE or such providers. These are server-server calls, no username, nor UI based user interaction is required. Whereas, on the other hand, the purpose of grant_type=authorization_code is to provide a UI facilitated per user interaction to get authenticated via Facebook/Google or 3rd party Auth provider so that a user can login via SSO into Salesforce without supplying salesforce username/password or if they are not using SAML based SSO.

Therefore both the use cases are completely different.

Now, salesforce does not support out of the box grant_type=client_credentials. In all documentation, it only supports creating a custom Auth Provider for implementing grant_type=authorization_code where you implement Auth.AuthProviderPluginClass class where it has the methods: getCustomMetadataType, getUserInfo, handleCallback, initiate and refresh. This means that this is a UI based OAuth 2.0 flow where:

Refer here for full article

1. Salesforce opens a browser to send the user to the OAuth server
2. The user sees the authorization prompt and approves the app’s request
3. The user is redirected back to Salesforce with an authorization code in the query string.
4. The application exchanges the authorization code for an access token

I am implementing the same APIGEE integration with Salesforce to make Apex Callouts from salesforce and get data from APIGEE APIs where they don't have open id connect and client_credentials grant type :

Refer this Named Credentials and support for the OAuth2 Client Credentials Grant Type and alternatives

GitHub Reference https://github.com/lekkimworld/salesforce-azure-clientcredentials-authprovider