I am looking to change a synchronous integration in my managed package with my third party web service to be asynchronous, so that a callout will post the information to my web service, and at some point in the future, my web service will post updated information back to Salesforce.
Looks like oAuth/Connected Apps is the way to go with this, and I think I have all the individual pieces working, but I am not sure about where to initiate/store the tokens. My current thinking is as follows
- Customer installs my managed package which will contain my client id/secret in a protected setting
- Clicks a config link to give get oAuth access for this org Link brings them back to a packaged VF page
- Page/Controller retrieves the auth code and gets the refresh token
- Stores Refresh token it in a protected custom setting.
Then, when I call my web service, it passes over the refresh token as part of the callout, my web service requests an access token and passes that back with the information to my rest service in my package.
Does that make sense? If so, how do I set the callback URL to display a page in my package regardless of the instance it is installed in? And is this approach going to pass muster with security review?