2

I've looked at this question

Server-Side REST Authentication

and many other forums with this same problem. I'm trying to access restful webservice we created in our salesforce instance with postman. I'm using this url https://login.salesforce.com/services/oauth2/token and these url params

grant_type=password
client_id={my id}
client_secret={my secret}
[email protected]
password={password}{security token}

I'm getting this response

{
  "error": "invalid_grant",
  "error_description": "authentication failure"
}

In the connected app settings, I've added my IP under trusted IPs. I've set IP Relaxation to "Relax IP restrictions". I set permitted users to "All users may self-authorize". I added my IP address under Administer->Security Controls->Network Access. Is there supposed to be a delimiter between password and security token in the password URL parameter? I can view my connected app through two views in salesforce.

When I go to Administer->Manage Apps->Connected Apps I see it there but when I hover the mouse over it, it doesn't say "Managed-Installed" and it doesn't have the little blue arrow next to the link. But when I click on it it says its installed

I also can view it through Develop->Remote Access which then redirects me to a page where I'm able to click on it and see the consumer key and consumer secret.

I tried sending a request from the developer console and I get the same error. I tried sending with and without the security token appended to the password. I do have the '@' character in the password, could that be causing a problem?

HttpRequest req = new HttpRequest();
req.setMethod('POST');
req.setEndpoint('https://login.salesforce.com/services/oauth2/token');
req.setBody('grant_type=password' + 
           '&client_id=' + 'id'+
           '&client_secret=' + 'secret' +
           '&username=' + '[email protected]' +
           '&password=' + 'password');
Http h = new Http();
HTTPResponse res = h.send(req);
System.debug('Body ' + res.getBody());
System.debug('Status ' + res.getStatus());
System.debug('Status code ' + res.getStatusCode());

Thanks @Eric, the problem was I'm in a test environment so I should be using test.salesforce.com not login.salesforce.com

0

1 Answer 1

2

Check the login history for the user and make sure you are connecting to the right url TEST vs LOGIN.

I am willing to bet that the Security Token is being required and you are not appending that to your password

You should be doing: &password={PASSWORD}{SECURITYTOKEN}

Login History Example

I used your code and once I added the IP to the allowed ranges (or appended the security token) it was successful.

HttpRequest req = new HttpRequest();
req.setMethod('POST');
req.setHeader('Content-Type','application/x-www-form-urlencoded');
req.setEndpoint('https://login.salesforce.com/services/oauth2/token');
req.setBody('grant_type=password' + '&client_id=xyz' + '&client_secret=xyz' + '&username=un' + '&password=pw');
Http h = new Http();
HTTPResponse res = h.send(req);
System.debug('Body ' + res.getBody());
System.debug('Status ' + res.getStatus());
System.debug('Status code ' + res.getStatusCode());

results in:

15:00:19.37 (660162883)|USER_DEBUG|[8]|DEBUG|Body {"access_token":"xyz","instance_url":"https://xxx.my.salesforce.com","id":"https://login.salesforce.com/id/xx/xx","token_type":"Bearer","issued_at":"1493838019636","signature":"xx"}

15:00:19.37 (660248503)|USER_DEBUG|[9]|DEBUG|Status OK 15:00:19.37

(660399942)|USER_DEBUG|[10]|DEBUG|Status code 200

Digging Deeper into OAuth 2.0 on Force.com

An autonomous client can obtain an access token by simply providing username, password and (depending on configuration) security token in an access token request. Again the request is POSTed (1) to https://login.salesforce.com/services/oauth2/token, but the payload now has the form

grant_type=password&client_id=&client_secret=&username=&password=

The following parameters are required:

  • grant_type Set this to password.
  • client_id Your application's client identifier.
  • client_secret Your application's client secret. username The API user's Salesforce.com
  • username, of the form [email protected].
  • password The API user's Salesforce.com password. If the client's IP address has not been whitelisted in your org, you must concatenate the security token with the password.
7
  • I'm not seeing any login attempts in the login history when I run my code or send the request from postman
    – gary69
    Commented May 3, 2017 at 18:36
  • I'm positive. I logged in, checked the login history and saw myself logging in from a browser. Then clicked my name on the top menu, opened developer console, and executed that code. I got a 400 bad request with that invalid_grant error and there was nothing in the login history
    – gary69
    Commented May 3, 2017 at 18:51
  • @gary69 - try adding req.setHeader('Content-Type','application/x-www-form-urlencoded'); although for me it worked without it. What is the error description it is giving you? Do you have IP restrictions enabled? Is your username a production username? if not you need to change to test.salesforce.com.
    – Eric
    Commented May 3, 2017 at 18:54
  • 1
    @gary69 Your username [email protected] makes it seem like you should be connecting to test.salesforce.com as it looks like a sandbox username
    – Eric
    Commented May 3, 2017 at 19:04
  • 1
    Yes!! Thank you, I needed test.salesforce instead of login.salesforce
    – gary69
    Commented May 3, 2017 at 19:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .