I am trying to make a login to an external salesforce org from my salesforce org. Below is the code using basic authentication but I get an error:

HttpRequest req = new HttpRequest();
// Because we didn't set the endpoint as a named credential, 
// our code has to specify:
// - The required username and password to access the endpoint
// - The header and header information

String username = 'username@test.com';
String password = 'passwordddd';

Blob headerValue = Blob.valueOf(username + ':' + password);
String authorizationHeader = 'BASIC ' +
req.setHeader('Authorization', authorizationHeader);

// Create a new http object to send the request object
// A response object is generated as a result of the request  

Http http = new Http();
HTTPResponse res = http.send(req);

I get an error back:

<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
            <faultstring>content-type of the request should be text/xml</faultstring>

I made the content type as 'application/xml' or 'application/text' but doesn't seem to work. I am guessing I am not doing this in the right way to authorize the endpoint.

  • 1
    The error message seems quite clear, no? Change the content-type to text/xml.
    – Adrian Larson
    May 10 '17 at 15:16
  • I made the change but I get an error now - POST requires content-length. I think I have to setBody for this but I have a JSON body. I am trying to hit an apex rest service present in another salesforce org. How do I make modification to code to hit that service endpoint? Any Idea?
    – SfdcBat
    May 10 '17 at 16:32

You can't use Basic Authentication with Salesforce. Instead, use the SOAP login() call or the OAuth Username-Password authentication flow.

  • Even using username-Password authentication flow, we need to define the calling org as connected app in the target org right(to get customer token)?
    – javanoob
    May 10 '17 at 16:34
  • @javanoob If you use username-password auth flow, you simply need a client ID of a connected app. It does not need to already exist in the target org. Or, you can use SOAP login, which does not require a connected app.
    – sfdcfox
    May 10 '17 at 16:53
  • Ok. I was under the impression that we should have the connected app defined in the target org. I just did some testing using the client and customer secret of a totally different app(defined in a 3rd org) and I am able to get access token(This might be a bad practice to use client id and customer secret of different app). Learnt new thing today. Thanks again!
    – javanoob
    May 10 '17 at 17:39
  • @javanoob Yes, definitely use your own connected app for this purpose.
    – sfdcfox
    May 10 '17 at 17:52
  • 1
    @SfdcBat The connected app can exist in either org (or even a third org). Once a login is established, no further authentication is necessary, because the system handles refresh tokens for you automatically.
    – sfdcfox
    May 17 '17 at 17:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.