I have a non-salesforce web application, and I want to secure it so only users of my SF org can use it. The data that I want to protect is stored in the web app, so my SF org should only serve as a SSO identitiy provider.

I have set up a connected app in my org and configured the web app with the client key and client secret. Now my web app redirects to salesforce for login, receives the token and all looks fine. Except all of the above is true for all salesforce orgs, not just mine - anybody with any salesforce login can log into my application.

I tried to verify the signature of the token message, hoping that other orgs won't have access to the client secret, but even that matches.

  • oAuth is NOT an authentication protocol, don't use it for that purpose. If you use SAML as the protocol in your connected app, you can pass extra information from SFDC to your app. Your app can then act on it. For example, you can pass the org id. – identigral Dec 10 '13 at 15:58

This can be resolved by enabling a mydomain feature of salesforce where user is in fact redirected to the unique login url of your salesforce instance, scoping the validity of provided credentials for that case.

| improve this answer | |
  • This does pretty much what I wanted. I created a domain for sites in the identity provider org, and used that domain as authentication URL. This stops users from authenticating from any other org right there in the login screen - I don't even have to verify the org Id in my connected app's callback. Your answer is a bit terse, but nudged me in the right direction. Thanks. – kresho Dec 16 '13 at 15:49

You can't prevent users from logging into any organization using a connected app. The point of a connected app is to allow any user to use the functionality from your app with their organization. Instead, you'll have to have your app verify the organization they've logged in to after the login occurs. You'll probably want to make a managed package for your connected app, and create a custom object that you can use to identify the organization they are logging into (e.g. if you try to describe objects and this custom object doesn't appear, they're not logged into the right organization). Using this method, you'd also be able to assign licenses to specific users for granular control over who has access to the app.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.