6

I am using the "/services/oauth2/token" end point with grant_type "password" (and with client_id, client_secret, username, password) from JavaScript code. With "IP Restrictions" set to "Relax IP restrictions" in the "Connected App" definition, this allows me to obtain an access_token by just supplying the username and password (no security token) which is good.

However, while this code works for a "System Administrator" profile user ("Salesforce" license), the same code does not work for a "High Volume Customer Portal" profile user ("High Volume Customer Portal" license); the latter profile has "API Enabled" checked. The error returned in that case is:

{"error_description":"expired access/refresh token","error":"invalid_grant"}

Is this a license type issue or have I just got some other inconsistency between the two users that is causing the problem?

(There is a mention of username/password in a comment in OAuth for Portal Users but it is rather brief.)

Improve this question
4
  • Have you tried with a Customer Community License user? It's the same security model and HVCP but it has some subtle differences, this might be one of them?
    – Steven Herod
    Nov 2, 2013 at 10:57
  • Thanks for the suggestion; as my org doesn't have that license listed I can't quickly test your suggestion. Do you have a link you could share that that describes the differences?
    – Keith C
    Nov 2, 2013 at 11:14
  • Why are you using username/password for HVCP users, rather than web server or user agent?
    – metadaddy
    Nov 6, 2013 at 20:35
  • The application is AngularJS packaged by PhoneGap Build and running inside iOS. So ideally no UI (login page etc) would come from the server: the server would just provide REST/JSON APIs (services). Once you have a session ID this all works well: the problem is how to get a session ID from JavaScript and OAuth username/password looked like one way. Is there a better way? Or is it just going to be necessary to serve the login etc pages from the server as HTML?
    – Keith C
    Nov 6, 2013 at 21:33

1 Answer 1

Reset to default
7

OAuth username-password for Portal/Communities users is not possible.

The usual approach to authenticating users to Salesforce in a mobile app is to pop up a webview with the OAuth user agent login URL and watch for the final redirect to the 'success' URL. I got this working with the PhoneGap ChildBrowser plugin a while ago; things have changed a lot in PhoneGap since then, but that shows the general approach.

On the other hand, if you REALLY want to do username/password, you can do SOAP login against the portal using LoginScopeHeader.

In general, the web-based login is preferred, since it will handle SSO from enterprise identity providers, Facebook, Google etc.

Improve this answer
8
  • Thanks. I take the point about allowing the sign-on to be varied at the server-side and am taking that approach now. Ugly in some ways though. Can you add a big "No" to your answer relating to the original question to perhaps save other people spending time trying to make it work?
    – Keith C
    Nov 6, 2013 at 22:10
  • Just went back and looked at the blog post comment - the 'no' there looks pretty unequivocal already!
    – metadaddy
    Nov 6, 2013 at 22:38
  • Yeah. But 'no' with a reason why carries more weight... Thanks again.
    – Keith C
    Nov 6, 2013 at 23:03
  • Is this still the case? Community users cannot oAuth authenticate into Salesforce?
    – James Loghry
    Aug 29, 2014 at 2:46
  • 1
    Community users can OAuth into Salesforce via web server or user-agent flows; just not username/password.
    – metadaddy
    Aug 29, 2014 at 6:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .