I am an ISVforce developer and I am trying to create a managed package for the AppExchange. Our app will make API requests to our external API. Our API requires an authentication token that we generate. I am trying to figure out the best way to authenticate on our end.
I'm leaning away from using OAuth because I don't want our salesforce customers to deal with setting up an Auth Provider to use our app. Ideally a client (salesforce admin) would install the package and it just works for all their users.
I've been following the official ISVforce Guide and came across the following recommendation:
"We recommend designing your external service to use the user ID and session ID to authenticate and identify users."
I have been searching for the best way to authenticate in this manner (or maybe I'm barking up the wrong tree). I found out in Apex we have access to both the user id and the session id via the UserInfo class.
I think the following flow could work for my situation:
Send user id and session id using an un-authenticated request to our API.
On our end authenticate and identify the user like the above quote say.
Our API generates and returns our authentication token.
Client receives our authentication token and can now make authenticated calls to our API.
I am stuck on step 2. How would we validate a salesforce user id and session id from our external resource like the guide suggests? Is this possible?