As per this link, The issuer (iss) must be the OAuth client_id **or** the connected app for which the developer registered their certificate. Does this mean can I use external application client id instead of connected app's client Id ?

Another question is "Can client_id be used instead of iss parameter to pass in client_id" ?

Use Case: External App user who wants to connect with Salesforce says they have restrictions in modifying existing JWT format and since they are currently using clinet_id to pass clientId, they want to continue using same instead of modifying it to iss. Also they want to use their existing clientId instead of using Salesforce connected app client Id.


tl;dr: No on both questions. Your external user is just going to need to suck it up and make the changes.

The documentation you linked doesn't go into detail about exactly what it means by "the connected app", but I suspect it means the API name of your connected app.

I would be very surprised if you could use the client_id of any OAuth enabled thing out there. I don't have anything I could try this with myself, so the quickest way for you to verify this would be to try it yourself.

The role of the (Salesforce) connected app in all of this is to provide a way for administrators to audit the authentication attempts, and some coarse-grained permission control. The connected app is also how Salesforce provides their (Salesforce's) authentication to external systems.

On your second question, the documentation is pretty clear on that.

The developer must create a valid JWT bearer token that conforms to RSA SHA256 according to the following rules.

  • The issuer (iss) must be the OAuth client_id or the connected app for which the developer registered their certificate.
  • The audience (aud) must be https://login.salesforce.com, https://test.salesforce.com, or, if implementing for a community, https://acme.force.com/customers (where acme.force.com/customers is your community URL).
  • The subject (sub) must be the username of the desired Salesforce user or, if implementing for a community, the Salesforce community user. For backward compatibility, you can use principal (prn) instead of subject (sub). If both are specified, prn is used.
  • The validity (exp) must be the expiration time of the assertion within 5 minutes, expressed as the number of seconds from 1970-01-01T0:0:0Z measured in UTC.
  • The JWT must be signed using RSA SHA256.
  • The JWT must conform with the general format rules specified here: http://tools.ietf.org/html/draft-jones-json-web-token.

If your external user is using 'client_id' in a JWT, that's non-standard (but allowed by the ietf rules linked above in documentation). Salesforce requires that you use "iss", "aud", "sub", and "exp"

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.