2

My managed package needs to access data from multiple Orgs. For example, say a user has 2 accounts: 1 in Org A, and 1 in Org B. When the user is logged in to Org A, they need to see data from both Org A and Org B. I experimented with obtaining an access token for Org B while the user was logged in to Org A. I created a web service that handled this process by using the Web Server OAuth flow. However, the problem I ran into was that at the point of making the initial request to get the authorization code, https://login.salesforces.com/services/oauth2/authorize, that is in the context of the current logged in user. So it never asks the user to log in to Org B since the user has already has approved access to our connected app in Org A. I thought that the OAuth connected app approval process might be independent of the context of the current logged in user, but that is not the case. Is there a way to get around that? Is there another OAuth flow that would work better? or is there another way of achieving this?

EDIT: Additional requirement: For each user that issues a cross-org query for data, the query needs to respect their security settings.

Improve this question
3
  • Have you looked at using Named Credentials for the integration? See Salesforce to Salesforce integration using Named Credential
    – Daniel Ballinger
    Commented Aug 1, 2017 at 21:46
  • Thanks @DanielBallinger, I did not know about this option. Another requirement I forgot to mention is that for each user that issues a query cross-org, I need to respect their security settings. This looks like it's creating the connection with the admin's privileges. I'll update the question with those reqs. Not sure if there is a way of handling that with this solution
    – Donuts
    Commented Aug 3, 2017 at 16:47
  • @DanielBallinger -Also, it looks like when you set up the authentication provider, specifically the callback urls and user setup, this is specific to MY orgs. I need this to work for all orgs that install my managed package.
    – Donuts
    Commented Aug 3, 2017 at 17:07

1 Answer 1

Reset to default
0

The best option was for me to use the username and password OAuth flow for cross-Org connections. That way, I was able to prompt the user for the username, password and security token to request the access token through my APEX controller in a single request. I can then just store the access token in a cookie or local storage. With this, you also need to add a CORS whitelist entry in your target Org(s). So if I'm in Org A and want to call the SalesForce REST endpoint in Orgs B and C, I need to add a CORS whitelist entry in Orgs B and C that refers to Org A, i.e. https://[OrgAInstance].salesforce.com. You can also use wildcards here if you wish.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .