I am looking to change a synchronous integration in my managed package with my third party web service to be asynchronous, so that a callout will post the information to my web service, and at some point in the future, my web service will post updated information back to Salesforce.

Looks like oAuth/Connected Apps is the way to go with this, and I think I have all the individual pieces working, but I am not sure about where to initiate/store the tokens. My current thinking is as follows

  • Customer installs my managed package which will contain my client id/secret in a protected setting
  • Clicks a config link to give get oAuth access for this org Link brings them back to a packaged VF page
  • Page/Controller retrieves the auth code and gets the refresh token
  • Stores Refresh token it in a protected custom setting.

Then, when I call my web service, it passes over the refresh token as part of the callout, my web service requests an access token and passes that back with the information to my rest service in my package.

Does that make sense? If so, how do I set the callback URL to display a page in my package regardless of the instance it is installed in? And is this approach going to pass muster with security review?



I can't comment on the security review part though I suspect it'll be ok. As for the rest of it it sounds like the right way to go, with the redirect part you can get away without using that. It's designed to facilitate the user experience, but if you're making the callouts using Apex you'll know when you get the token back and you can take action yourself.

Can't find the code right now but I've used oAuth to authenticate with google for now using oob (Out Of Band) for the callback URL.

  • I think I missing something then - I've been following the Web Server Flow in this article (wiki.developerforce.com/page/…) I assume I have to execute the first request to get the code in the org I just installed the package in, and use that to get an access token. But to get access to that first code, don't I need to redirect the user somewhere where I can read the URL params and request the second piece - which would have to be a VF page in that instance that can then update the custom setting? Or am I over complicating this (quite possible)? – BritishBoyinDC Oct 2 '13 at 3:04
  • Just for clarity, it's not "out of bounds", but "out of band." Out of band requests are those that are done outside the normal OAuth flow (e.g. because the authentication mechanism has a custom callback). – sfdcfox Nov 2 '13 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.