8

I have a native ios app and i want to login using the username password flow, From the POC i made i discovered that for community user, i dont get a security token which i was using while REST call to https://login.salesforce.com/services/oauth2/token

So I want to know is it possible to use username-password flow with community user.

I have already gone through other answers related to same questions in the community, none of them worked for me.

I have checked following links,

Username-Password OAuth Authentication is working with the community users?

How to check community user credentials via api

Customer Community login using REST API

also there are few links that suggest using soap API for authentication I tried a curl request but it didn't worked

https://developer.salesforce.com/docs/atlas.en-us.api_asynch.meta/api_asynch/asynch_api_quickstart_login.htm

curl https://uat-uat-rnc.cs8.force.com/callcenter/services/Soap/u/41.0 -H "Content-Type: text/xml; charset=UTF-8" -H "SOAPAction: login" -d @login.txt

heres the content of login.txt

 <?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="urn:partner.soap.sforce.com">
  <SOAP-ENV:Header>
    <ns1:LoginScopeHeader>
      <ns1:organizationId>00Dl00Gt0000CrM</ns1:organizationId>
<ns1:portalId>0DB0l000888ZVGA2</ns1:portalId>
 </ns1:LoginScopeHeader>
</SOAP-ENV:Header>
  <SOAP-ENV:Body>
    <ns1:login>
      <ns1:username>harry@rnc.com.ccu</ns1:username>
      <ns1:password>India</ns1:password>
    </ns1:login>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

2 Answers 2

8

In the profile of the user make it as API enabled.

enter image description here

I was able to log in using api inside the community using the below soap login call.,

<Envelope xmlns="http://schemas.xmlsoap.org/soap/envelope/">
<Body>
    <login xmlns="urn:tooling.soap.sforce.com">
        <username>tomxxx@dsssd.com</username>
        <password>Nexxwussa123</password>
    </login>
</Body>
</Envelope>

Also make sure you include header as

SOAPAction : Soap

endpoint: https://test.salesforce.com/services/Soap/T/41.0

<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns="urn:tooling.soap.sforce.com" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<soapenv:Body>
    <loginResponse>
        <result>
            <metadataServerUrl>https://foooodle--UAT.csx7.my.salesforce.com/services/Soap/m/41.0/00D8E00x009MIn</metadataServerUrl>
            <passwordExpired>false</passwordExpired>
            <sandbox>true</sandbox>
            <serverUrl>https://foooodle--UAT.csx7.my.salesforce.com/services/Soap/T/41.0/00D8E0000009MIn</serverUrl>
            <sessionId>00D8xx0009MIn!AQUAQAKlWxxuowH_1DK7ic52WzqCrxgyDRaPsrr9L8JgGRpv7l5oBmVFJGSs2tsKuxWAPum7vT2IlM7AuGt7vf.qG.3M8R_</sessionId>
            <userId>0058E0000xxWmT4QAK</userId>
            <userInfo>
                <accessibilityMode>false</accessibilityMode>
                <chatterExternal>false</chatterExternal>
                <currencySymbol>£</currencySymbol>
                <orgAttachmentFileSizeLimit>5242880</orgAttachmentFileSizeLimit>
                <orgDefaultCurrencyIsoCode>GBP</orgDefaultCurrencyIsoCode>
                <orgDefaultCurrencyLocale>en_GB</orgDefaultCurrencyLocale>
                <orgDisallowHtmlAttachments>false</orgDisallowHtmlAttachments>
                <orgHasPersonAccounts>true</orgHasPersonAccounts>
                <organizationId>00D8x00009MInUAM</organizationId>
                <organizationMultiCurrency>false</organizationMultiCurrency>
                <organizationName>Pranya Finance</organizationName>
                <profileId>00e580000xydBAAQ</profileId>
                <roleId>00E8E0000xbcdhUAA</roleId>
                <sessionSecondsValid>28800</sessionSecondsValid>
                <userDefaultCurrencyIsoCode xsi:nil="true"/>
                <userEmail>pranayx@nce.com</userEmail>
                <userFullName>Tom Dealer tomm</userFullName>
                <userId>0058E000xWmT4QAK</userId>
                <userLanguage>en_US</userLanguage>
                <userLocale>en_GB</userLocale>
                <userName>tomxxx@dsssd.com</userName>
                <userTimeZone>Europe/London</userTimeZone>
                <userType>PowerPartner</userType>
                <userUiSkin>Theme3</userUiSkin>
            </userInfo>
        </result>
    </loginResponse>
</soapenv:Body>

You can also use this to call custom Apex Rest/Soap Webservices. It saves costs than using a full platform user license as Integration user.

3
  • This looked mighty promising, unfortunately for use we keep getting Invalid username, password, security token; or user locked out for non-sandbox community user
    – zaitsman
    Mar 4, 2021 at 3:42
  • @zaitsman what do you mean? I have used this in production. Mar 4, 2021 at 9:25
  • The envelope you posted did not work for me, I had to add <urn:organizationId>ORGIDHERE</urn:organizationId> to get the session id.
    – zaitsman
    Mar 4, 2021 at 9:27
0

A better one that works...

Make authrequest.xml file:

<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:enterprise.soap.sforce.com">
  <soapenv:Header>
    <urn:LoginScopeHeader>
      <urn:organizationId>00D3000034343yn</urn:organizationId>
    </urn:LoginScopeHeader>
  </soapenv:Header>
  <soapenv:Body>
    <urn:login>
        <urn:username>williambell9708@email.com</urn:username>
        <urn:password>ddsds5354342</urn:password>
    </urn:login>
  </soapenv:Body>
</soapenv:Envelope>

And call it with:

curl -X POST -d @authrequest.xml https://login.salesforce.com/services/Soap/c/36.0 --header "Content-Type: text/xml; charset=UTF-8;" -H "SOAPAction: login"

Then look into the result for token...

2
  • Use of login.salesforce.com suggests this is for a Salesforce or Salesforce Platform user rather than a Community User. Are you sure you are answering the question?
    – Phil W
    Mar 6 at 8:23
  • Worth also noting Saleforce explicitly recommends against this approach as it is a security risk.
    – Phil W
    Mar 6 at 8:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.