We have developed a portal accessed by users who use our product - a desktop application. In addition to what our desktop app does, it needs to make API calls directly to Salesforce, authenticated as the user. This means we want our desktop app to be able to accept salesforce credentials for our user and the desktop app will make an auth call against SF, fetch the token and then use that for subsequent API calls to Salesforce.
The problem is that the initial auth call requires not only a username and password but also a security token and for various reasons we dont want the users to have to enter that security token into the Desktop app directly.
We have a mechanism by which an Apex page launches our app and passes in some key information about the user who is launching the app and the best thing would be to be able to pass the security token of the logged in user at that point. Then the App could use the security token if an API Auth call needs to be made, along with the user's entered credentials.
The problem is that I dont see any way to access the users security token via apex code. So there is no way to pass this token to the desktop app when launching it? An additional problem is that we are using IP whitelisting which means even if we wanted our users cannot retreive the security token themselves (even if they wanted to).
All of the above tells me that there must be some other approach that would allow us to get our desktop app to authenticate against salesforce?
Any ideas and suggestions would be appreciated? Or clarity as to what I am missing!
