We'd like Apex code to call an in-house developed API and pass the current user's identity.

Our users sign-in to Salesforce using their corporate GSuite/Google account account via SAML. Ideally, the SAML token or a derived JWT token can be inspected in Apex and sent along with the API call.

  • We've built this GraphQL API in-house so can adapt the authentication mechanism to whatever Salesforce can provide
    – Brian Low
    Jun 21, 2018 at 0:51

1 Answer 1


Short answer: rolling a JWT token yourself in Apex is a way to go.

Longer answer:

After the user has been signed in, their identity will be available via SF APIs callable from Apex. From there, you're on your own in terms of grabbing that user identity and propagating it to your API. You have to develop the pieces in Apex that will lead to authentication primitives in the request from SF to your GraphQL API. You won't be able to elegantly reuse out-of-the-box SF support for auth protocols such as SAML because you're operating at a (lower) platform level. Even though you can kinda sort implement the reuse by (for example) issuing a HTTP response with a 302 redirect from your Apex code to a link your SF org that will kick off the auth sequence, you'll be mixing asset classes (Apex code + SF configuration + various SF platform assumptions) that'll make your life difficult. Therefore, your best option is stay in Apex and generate whatever token you can live with on the other side. JWT seems to be the easiest.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .