I am using the "/services/oauth2/token" end point with grant_type "password" (and with client_id, client_secret, username, password) from JavaScript code. With "IP Restrictions" set to "Relax IP restrictions" in the "Connected App" definition, this allows me to obtain an access_token by just supplying the username and password (no security token) which is good.

However, while this code works for a "System Administrator" profile user ("Salesforce" license), the same code does not work for a "High Volume Customer Portal" profile user ("High Volume Customer Portal" license); the latter profile has "API Enabled" checked. The error returned in that case is:

{"error_description":"expired access/refresh token","error":"invalid_grant"}

Is this a license type issue or have I just got some other inconsistency between the two users that is causing the problem?

(There is a mention of username/password in a comment in OAuth for Portal Users but it is rather brief.)

  • Have you tried with a Customer Community License user? It's the same security model and HVCP but it has some subtle differences, this might be one of them? Nov 2 '13 at 10:57
  • Thanks for the suggestion; as my org doesn't have that license listed I can't quickly test your suggestion. Do you have a link you could share that that describes the differences?
    – Keith C
    Nov 2 '13 at 11:14
  • Why are you using username/password for HVCP users, rather than web server or user agent?
    – metadaddy
    Nov 6 '13 at 20:35
  • The application is AngularJS packaged by PhoneGap Build and running inside iOS. So ideally no UI (login page etc) would come from the server: the server would just provide REST/JSON APIs (services). Once you have a session ID this all works well: the problem is how to get a session ID from JavaScript and OAuth username/password looked like one way. Is there a better way? Or is it just going to be necessary to serve the login etc pages from the server as HTML?
    – Keith C
    Nov 6 '13 at 21:33

OAuth username-password for Portal/Communities users is not possible.

The usual approach to authenticating users to Salesforce in a mobile app is to pop up a webview with the OAuth user agent login URL and watch for the final redirect to the 'success' URL. I got this working with the PhoneGap ChildBrowser plugin a while ago; things have changed a lot in PhoneGap since then, but that shows the general approach.

On the other hand, if you REALLY want to do username/password, you can do SOAP login against the portal using LoginScopeHeader.

In general, the web-based login is preferred, since it will handle SSO from enterprise identity providers, Facebook, Google etc.

  • Thanks. I take the point about allowing the sign-on to be varied at the server-side and am taking that approach now. Ugly in some ways though. Can you add a big "No" to your answer relating to the original question to perhaps save other people spending time trying to make it work?
    – Keith C
    Nov 6 '13 at 22:10
  • Just went back and looked at the blog post comment - the 'no' there looks pretty unequivocal already!
    – metadaddy
    Nov 6 '13 at 22:38
  • Yeah. But 'no' with a reason why carries more weight... Thanks again.
    – Keith C
    Nov 6 '13 at 23:03
  • Is this still the case? Community users cannot oAuth authenticate into Salesforce? Aug 29 '14 at 2:46
  • 1
    Community users can OAuth into Salesforce via web server or user-agent flows; just not username/password.
    – metadaddy
    Aug 29 '14 at 6:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.