4

I developed a standalone application using REST API to extract Salesforce data using a Connected App. The application uses OAuth 2.0 Web Server Flow to authenticate users. I am following the specified guidelines for extraction such as the maximum number of API Calls.

The Connected App was created in my organization, therefore I have access to Secret Key and Client ID. This is not a Canvas Connected App, as I need to trigger the extraction from outside of Salesforce. I know how to package a Canvas Connected app, but I haven't found information regarding how to distribute a Connected App.

  1. How can I distribute this Connected App to my clients?
  2. How will this standalone application be tested during the security review?
  3. In case it is not possible to distribute the connected app. Every client needs to create their own Connected App, and introduce the Client ID + Secret Key in the standalone application?
Improve this question

2 Answers 2

Reset to default
2

Connected apps are automatically installed in an org the first time you use it in that org. There is no need to create a package for that purpose.

As far as the Security Review goes, they'll have you submit a BURP scan report for your app. Once approved, your Connected App may be granted the special permission that allows access to Professional Edition orgs.

Improve this answer
8
  • Thanks, this is different from what @MohithShrivastava mentioned. What do you mean "Connected apps are automatically installed in an org the first time you use it in that org"?
    – Hugo
    Commented Nov 27, 2017 at 9:08
  • Regarding BURP Scan, Is there any tool I should use to make the BURP scan? Where can I read more about BURP Scan for standalone REST API extractors?
    – Hugo
    Commented Nov 27, 2017 at 9:16
  • @Hugo They changed the UI since I last looked, but basically if you go to Setup > Manage Apps > Connected Apps OAuth Usage, your app will appear here once a user uses the app, and the admin can choose to "Install" it to manage its permissions. No need to create a package for it to be installable. For burp scanning, see this page (future visitors: if this link is dead, just search "salesforce burp scanner").
    – sfdcfox ♦
    Commented Nov 27, 2017 at 9:27
  • By using the app, you mean whenever a user goes to the OAuth handshake - Authorizes the app to access the org?
    – Hugo
    Commented Nov 27, 2017 at 9:50
  • 1
    @Hugo Yes, that's how it works. For example, the Developer Workbench does not have an AppExchange listing yet can be used by users with API Access, as well as things like Salesforce DX, which also doesn't have a package to install. You can create your own Connected Apps as well. The reason for the security review is so that you can gain additional API privileges by proving you have a secure app. For example, your Connected App can be granted additional permission to work in orgs without API (e.g. Professional Edition).
    – sfdcfox ♦
    Commented Nov 27, 2017 at 9:58
2

You can create a managed package application and add connected application to it .

Your clients will just install this managed package and provide access to the profiles and permissions needing access to the connected app.

The clientid and secret won't be visible to the subscriber and is fixed for the connected application .

Security review will review the managed package .

Improve this answer
1
  • Thanks for your answer. @sfdcfox mentioned there is no need to create a package for this purpose. Have you added a connected app (Non-canvas to a package before), do you have a link to how to do this?
    – Hugo
    Commented Nov 27, 2017 at 8:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .