I have external data source configured in Salesforce, it connects to OData 4.0 API. Let's say I have 1 external object in this data source, called Kitten. The problem: I want security to be handled on the backend API side, so each API call needs to be accompanied by some kind of Salesforce user identification.
For example: when user "John Doe" creates a new Kitten, the API request sent by Salesforce Connect OData 4.0 connector needs to include information identifying user "John Doe", preferably his Salesforce ID (e.g.
What I tried: in external data source configuration, I set "Identity Type" to "Per User" (so each request is bound to the user performing the action). As for "Authentication Protocol", "Password Authentication" is useless because it sends basic HTTP auth header with user/pass pair that the Salesforce User sets up for this particular connection.
So I tried OAuth 2.0, which seems to make most sense. I created a new Auth Provider of "Salesforce" type, with default values in all optional fields.
Now as a user I configure access ("Authentication Settings for External Systems" in "My settings"), grant access and voilà - now API requests made by Salesforce on this user's behalf contain auth header:
authorization: 'Bearer 00D1N00****blah*blah******'
Here's the problem - what do I do with this token to find out which user is making this particular request? I tried using it to connect to the UserInfo Endpoint (
https://login.salesforce.com/services/oauth2/userinfo), but I'm getting a response of "Bad_OAuth_Token".
I'm trying not to ask too specific a question here, because maybe the solution I'm struggling with is not the right way to do it. Any clues?