I have a fully working connected app, and now I want to authorize only managed package licensed users. Let's assume the managed package namespace is xyz.


  • ISV A releases xyz
  • Company B has 100 salesforce users in its org
  • Company B buys and assigns 10 xyz licenses to 10 users
  • ISV A releases an external service and wants that only their licensed users can access it (for Company B only those 10 licensed users)

Question 1: What would be the best approach to the previous point?

Attempt 1

  1. Create a Connected App with OAuth to authorize the salesforce users
  2. Customize the behaviour with a custom ConnectedAppPlugin enter image description here
  3. ConnectedAppPlugin body:

    global class CustomConnectedAppPlugin extends Auth.ConnectedAppPlugin {
        global override boolean authorize(Id userId, Id connectedAppId, boolean isAdminApproved, Auth.InvocationContext context) {
            User user = [select Id, Username from User where Id = :userId];
            System.debug('User requesting authorization: ' + user.Username);
            boolean result = ![select Id from UserPackageLicense where PackageLicense.NamespacePrefix = 'xyz' and UserId = :userId].isEmpty();
            System.debug('Connected App Plugin authorized: ' + result);
            return result;

Considerations about attempt 1

  • I intentionally left the Run As field blank, because in the documentation I found this sentence:

    The class runs on behalf of the current user of the connected app. This user must have permission to use the connected app for the plug-in to work.

Attempt 1 result

The custom ConnectedAppPlugin code is never called.

Attempt 2

Same as Attempt 1, but specifying a sys admin in the Run As field

Considerations about attempt 2

In the documentation I found the following (not very helpful) explanation about the Run As field:

For Run As, select the name of the user to run the plugin as. The plug-in runs on behalf of a user account. If the user isn’t authorized for the connected app, use the authorize method to do so. For more information, see the ConnectedAppPlugin class in the Apex Code Developer's Guide.

Attempt 2 result

If I try to get the authorization logging in as a random user, the authorize method always receives (surprise) the userId of the Run As user, but at least the code in the custom ConnectedAppPlugin is executed.

Question 2: what am I missing?

  • According to the documentation the userId parameter is the 15-character ID of the user attempting to use the connected app. So it is strange that you are seeing the Id of the Run As user. – Folkert Jul 9 '18 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.