2

My managed package needs to access data from multiple Orgs. For example, say a user has 2 accounts: 1 in Org A, and 1 in Org B. When the user is logged in to Org A, they need to see data from both Org A and Org B. I experimented with obtaining an access token for Org B while the user was logged in to Org A. I created a web service that handled this process by using the Web Server OAuth flow. However, the problem I ran into was that at the point of making the initial request to get the authorization code, https://login.salesforces.com/services/oauth2/authorize, that is in the context of the current logged in user. So it never asks the user to log in to Org B since the user has already has approved access to our connected app in Org A. I thought that the OAuth connected app approval process might be independent of the context of the current logged in user, but that is not the case. Is there a way to get around that? Is there another OAuth flow that would work better? or is there another way of achieving this?

EDIT: Additional requirement: For each user that issues a cross-org query for data, the query needs to respect their security settings.

  • Have you looked at using Named Credentials for the integration? See Salesforce to Salesforce integration using Named Credential – Daniel Ballinger Aug 1 '17 at 21:46
  • Thanks @DanielBallinger, I did not know about this option. Another requirement I forgot to mention is that for each user that issues a query cross-org, I need to respect their security settings. This looks like it's creating the connection with the admin's privileges. I'll update the question with those reqs. Not sure if there is a way of handling that with this solution – Donuts Aug 3 '17 at 16:47
  • @DanielBallinger -Also, it looks like when you set up the authentication provider, specifically the callback urls and user setup, this is specific to MY orgs. I need this to work for all orgs that install my managed package. – Donuts Aug 3 '17 at 17:07
0

The best option was for me to use the username and password OAuth flow for cross-Org connections. That way, I was able to prompt the user for the username, password and security token to request the access token through my APEX controller in a single request. I can then just store the access token in a cookie or local storage. With this, you also need to add a CORS whitelist entry in your target Org(s). So if I'm in Org A and want to call the SalesForce REST endpoint in Orgs B and C, I need to add a CORS whitelist entry in Orgs B and C that refers to Org A, i.e. https://[OrgAInstance].salesforce.com. You can also use wildcards here if you wish.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.