14

I'm trying to do an APEX Callout to a OAuth 2.0 secured REST API

This is the API https://developers.pandadoc.com/v1/reference#authentication-process

I want to use something to manage the security token rather than write APEX code to do it. And according to this that's what Named Credentials are for. Specifically this passage:

Salesforce manages all authentication for callouts that specify a named credential as the callout endpoint so that you don’t have to. You can also skip remote site settings, which are otherwise required for callouts to external sites, for the site defined in the named credential.

The problem I have is I'm trying to use an Auth Provider but there's no OAuth 2.0 option so I'm using OpenID. Which if I understand correctly rides on OAuth 2.0. I'm not sure what the "Redirect URI" should be from the PandaDoc API side. I'm using the "Callback URL" but it's not working.

I have the whole flow working in Postman from the Collection PandaDoc publishes. They also have a video showing the Postman setup. I'm able to use the builtin Postman OAuth 2.0 Authorization to get the Access Token and make successful calls to the PandaDoc API.

In my case I'm calling PandaDoc API but this would be useful for anyone calling out from Salesforce to any OAuth 2.0 secured API. I didn't find any good examples of how to make an Apex Callout to an OAuth 2.0 REST API.

Improve this question
6
  • I can think of two things right-away. Are you setting the correct content-type? Also, what do you see in the Panda-Doc console for redirect uri?
    – abhi
    Commented Jul 24, 2017 at 21:48
  • Neither the "Named Credential" or "Auth. Provider" have a setting for content type. I get the error when I'm trying to save the Named Credential for PandaDoc because I have the box checked to "Start Authentication Flow on Save" The error I get from PandaDoc is: "The requested redirect didn't match the client settings." I'm not sure where to look in PandaDoc for a console.
    – HungryPipo
    Commented Jul 25, 2017 at 20:53
  • Perhaps you would be better served at Panda Doc Edit: I see you've already posted this.
    – abhi
    Commented Jul 26, 2017 at 11:36
  • Already trying that too, but honestly it's more of a Salesforce question because the API works through Postman. What I need to know is how to do the same thing in Salesforce.
    – HungryPipo
    Commented Jul 26, 2017 at 18:01
  • 2
    I know I can hardcode the flow but what I'm looking for infrastructure to manage the connection and tokens as is described in the section in the documentation I highlighted. Is hard coding what others are doing? It seems there should be a better way.
    – HungryPipo
    Commented Jul 27, 2017 at 23:29

1 Answer 1

Reset to default
2

Named credential does have oAuth 2.0, the problem is with the Auth Provider. (I believe)

  • Select Identity Type as "Named Principle"
  • Then Select oAuth 2.0 as the Protocol

You will need to set up the AuthProvider as well and if they do not support OpenID Connect then you will need to create a custom auth provider according to the HELP document. I do not think it is a trivial exercise

The steps to do so are pretty detailed but one of the items in the registration class that is relevant to your question is quoted below

Existing User Linking URL—Use to link existing Salesforce users to a third-party account. The user opens this URL in a browser, signs in to the third party, signs in to Salesforce, and approves the link

Someone please correct me if I am wrong in that since the desire here is to get a token for the external system a custom provider may need to be implemented.

Improve this answer
6
  • I don't understand the need to "create a custom provider" my auth provider is the webservice I'm calling FROM Salesforce. The way I'm understanding the Auth Provider is I should be able to configure that to be in this case Panda Doc. Why doesn't Salesforce have a oAuth 2.0 provider in the list of options? It has Google, Facebook, Twitter and GitHub.
    – HungryPipo
    Commented Aug 29, 2017 at 14:50
  • @HungryPipo - Was struggling with that myself but I think that in order to setup the oAuth flow to the external system a "Provider" needs to be configured. I'll admit I am not 100% on the terminology and reasons why just that it would seem to be the only way to do it. I would assume since SF maintains the credentials it needs all the configuration to be able to automatically request, access, and update the tokens. May be easier to just store the tokens in a private custom setting
    – Eric
    Commented Aug 29, 2017 at 14:53
  • @HungryPipo - If you want to see what the process looks like set up a named credential and provider to another SF instance. Then you may get an Idea of why you need to setup PandaDoc as a provider. If PandaDoc supported OpenID Connect then you would not need to do all that
    – Eric
    Commented Aug 29, 2017 at 14:54
  • 5
    @HungryPipo - I could not find any example where others have used named credentials and oAuth with anything but Salesforce or the listed providers. Typically they used username and password for those. It also struck me that all the documentation about named credentials and auth providers all seem to focus on access TO the SF instance.
    – Eric
    Commented Aug 29, 2017 at 14:56
  • 1
    Maybe @sfdcfox has some insight. I am interested on the direction for this as well. Sorry sfdcfox for at mentioning you directly but trying to pick your brain here.
    – Eric
    Commented Aug 29, 2017 at 14:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .