0

What's the relationship between ConnectedApp and the Organizations they are defined in?

I have defined a ConnectedApp in one org (org 1) with API access enabled, and it seems that I can use the client_id and client_secret of that connected app to obtain an access token to a different organization (org 2) using an user account defined in Org 2.

Org 1 and Org 2 does not share the connected app in anyway? Is this behavior correct?

I was under the impression that ConnectedApp should only enable access to orgs in which the connected app is installed in. Is that understanding wrong?

Improve this question

1 Answer 1

Reset to default
1

A Connected App represents the "identity" of an application. For example, when you use the Data Loader, it uses a specific Connected App that's presumably hosted in Org 62, no matter which org you use it with. Doing this allows Salesforce to revoke access to a specific application, without preventing a user from logging in successfully.

You can think of this to be similar to how Facebook allows you to identify with various websites and games; each application gets a unique identifier that allows you, the user, to know which applications you're using, and to revoke access to a specific application without having to log out completely and/or change your password.

The first time a user uses an application in an org, it creates a limited Connected App that administrators can use to control or block access to a specific application, such as allowing only certain profiles to use it, or limit the data the application is allowed to access.

A Connected App exists in only one org, but can be used in any number of other orgs in order to enhance users' capabilities, such as logging Chatter Posts, importing or exporting data, etc.

Improve this answer
13
  • Thank you @sfdcfox, it makes sense. But I can't find any trace of the Connected App in Org 2 (to which obtain and access token using an Org 2 user account), except for the Login history of the particular user. (Info: I'm using OAuth2 password flow to get the access token, and the user is an administrator account). Question is, how does Org 2 prevent my Connected App from accessing Org2's API?
    – BuddhiP
    May 7, 2018 at 7:21
  • 1
    @BuddhiP You should not be using the password flow other than for testing purposes. Still, to block it, they should be able to go to Setup > Manage Apps > Connected App OAuth Usage, and click the Block button to block it, or Install to install it and configure the permissions for the app.
    – sfdcfox
    May 7, 2018 at 12:21
  • Thanks again @sfdcfox. Is there any other recommend way to authenticate an External service to a SF org, which need to call custom REST controller, if we can't expect for an interactive user to be available every time server need to talk to SF?
    – BuddhiP
    May 17, 2018 at 6:21
  • @BuddhiP You don't need to authenticate in realtime all the time if you have a connected app, just the first time. That's the one of the features of a connected app.
    – sfdcfox
    May 17, 2018 at 6:38
  • 1
    @wesaw I did see your other question, and unfortunately, this is one of those things I don't really know. I myself have a connected app I created for a desktop project I was working on, and now I can't find the org I created it in. As far as I know, the only real choice is to create a new connected app and try to not lose it. That said, have you tried contacting support? If there's a chance they can recover it, I'd love to know.
    – sfdcfox
    Oct 5, 2021 at 17:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .