For example site: aside.io, when we click Sandbox login, it takes you to test.salesforce.com and then when you enter your user name and password it authenticates and redirects to the aside.io with the classes and other files from that org?

While creating my own apex editor I was reading the USerName and password+security token via properties file. But now I have to implement the login screen same as what aside.io does.

What resources should I read to achieve this? Does aside.io store the username and password? Or how do they download and the files and deploy the files ? I suspect it through cookies? Is there any example i can follow?


This is the OAuth 2.0 User-Agent Flow. Using this mechanism, you set up a Connected App, which sets an icon, name, and "scope" (permissions) for your application. Your application, in turn, directs the user's browser to a particular URL to proceed with the Salesforce login. Salesforce provides the login screen and handles the username/password/two-factor/verification etc for you. At the end of the flow, Salesforce redirects to your callback URL and provides you with a session ID (called an Access Token). The only thing you store is the Access Token. The username/password/security token/etc are unknown to your application, which is a lot safer for you and your users. You do get an Identity URL if you need to identify a user in an external database, and there are API calls to get the user's details (e.g. name and email, but notably not the user's password).

| improve this answer | |
  • So that means when I set up a Connected App will i get some unique Id, as we get when developing Social login via gmail. I better try. Thanks – Nagendra K S Mar 29 '18 at 14:13
  • So I have successfully implemented oauth logic, but I had to create a connected app in my org and then get the client_id and have a onclick on my JS : as window.open('https://' + orgType + '.salesforce.com/services/oauth2/authorize?response_type=code&client_id=3MVG9d8..z.******&redirect_uri=https://4260e7c7.ngrok.io/html/apexEditor.html&state=' + (orgType === 'test' ? 'a' : 'b'), '_self'); But what if a new org wants to use my editor, do I have to create this connected app in each and every org? – Nagendra K S Mar 30 '18 at 15:58
  • Also I got this return https://4260e7c7.ngrok.io/html/apexEditor.html?code=*%3D%3D&state=b – Nagendra K S Mar 30 '18 at 16:14
  • @RahulJain No. Connected apps don't need to be installed in each org. It happens automatically on first use. The "code" you get needs to be redeemed for a token before you can use it. Try using the User-Client flow instead. – sfdcfox Mar 30 '18 at 16:26
  • 1
    @RahulJain You don't need to log in; an access token means you're already logged in. Just call the appropriate REST endpoints as necessary. – sfdcfox Mar 30 '18 at 19:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.