2

I'm using SF Restful API to develop an app. A generic use case of the app would be:

  1. User logs into the app (app specific credentials)
  2. User requests data available @ SF.
  3. App knows that user is allowed to access this data, so on behalf of user, app makes request to SF and retrieves data and displays to user.

This is different from what's instructed here under OAuth 2.0 Basics: https://help.salesforce.com/articleView?id=remoteaccess_authenticate_overview.htm&type=0 OAuth 2.0 SSO

Instead, the flow implemented for my app looks something like: Desired pattern

I feel like I'm using this architecture only for a lack of better one for my use case. Am I unaware of a flow where this is achieved? I want a single token for my app so it can access data in SF cloud using RESTful API.

I hope I was able to explain myself clearly, if not, please ask and I will expand further.

Thanks :)

Improve this question
4
  • Are the users of your app licensed Salesforce Users who have Salesforce Accounts whose individual data you want to access? Or, is it a case where you want to store data about them (perhaps just survey questions or contact info) in Salesforce where they are not Salesforce users or even Community License Users of any kind?
    – crmprogdev
    Commented Jul 22, 2018 at 11:45
  • 1
    @crmprogdev my users need to access data stored in SF but they don't necessarily have SF accounts for themselves.
    – Airwavezx
    Commented Jul 22, 2018 at 11:46
  • Ok, so it sounds like the data isn't unique to the user? The data is "shared" among users from a common database?
    – crmprogdev
    Commented Jul 22, 2018 at 11:56
  • 1
    Yes @crmprogdev, the users that are permitted to use my app are permitted to see data stored in SF.
    – Airwavezx
    Commented Jul 22, 2018 at 12:10

2 Answers 2

Reset to default
2

From your description, it isn't the user who needs to login to Salesforce. Instead, this is a Server initiated login for integration purposes with Salesforce. I would recommend you set up a JWT Bearer Token integration with Salesforce using Named Credentials to connect your server with Salesforce as needed. Your server will simply need a dedicated Salesforce API User to log-in to Salesforce to retrieve and save data to Salesforce as needed. Your actual users and their individual credentials aren't involved in the transaction.

In essence, all you need to do is set up the integration that will be set off by an http services call from your web server. OAuth would be the protocol for the login to Salesforce using a JWT Bearer Token. You'll also want to use TLS (SSL) and a Certificate for security purposes. Again, this is a Server initiated call on behalf of the user where you're using Server credentials (the dedicated integration user) to make the call.

Improve this answer
5
  • Thank you. This is exactly what I'm doing at the moment, apart from JWT flow. I'm using 'User-Pass' flow. The next thing I need to take care of is, as you said, SSL certificates. Since I'm already OCCASIONALLY receiving unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException . But it only happens occasionally (WEIRD?), and if I perform the request a couple of times the request eventually succeeds. Before I dig deeper into it, do you have any suggestions on how to solve? Our sys admin said that the servers have our certs imported
    – Airwavezx
    Commented Jul 22, 2018 at 12:31
  • 1
    Salesforce requires that you have a CA Signed certificate in order to connect to them. That's likely the issue you're encountering. From the Salesforce end, you can use a self-signed certificate if your organization will accept it. However, Salesforce will not. A username-password login is less secure than a JWT flow. Your certificate should also be included in the header when requesting the authentication token.
    – crmprogdev
    Commented Jul 22, 2018 at 12:49
  • How do I include my certificate in the header? Can you provide an example? @crmprogdev thanks
    – Airwavezx
    Commented Jul 22, 2018 at 12:58
  • I believe it appears in the header. In Apex, the commands are like this: HttpRequest req = new HttpRequest(); req.setClientCertificateName('DocSampleCert'); See developer.salesforce.com/docs/atlas.en-us.apexcode.meta/…
    – crmprogdev
    Commented Jul 22, 2018 at 13:05
  • Thank you. I will look further into how to add it to my HTTP request's header. Marked as answer :)
    – Airwavezx
    Commented Jul 22, 2018 at 13:17
1

Your diagram is just on a higher level of abstraction which explains how app users can use Salesforce data.

What I was able to assume from your explanation is you have an API user to connect your app (client) with Salesforce (resource server). To make that possible your app should authenticate itself with Salesforce by utilizing one of the OAuth flows. Your app probably follows the OAuth 2.0 Username-Password Flow. It implies that it stores API user credentials (login/password or a refresh token) and use them to get an access token. So you see OAuth 2.0 Basics is used in your app too

If you are fine with this implementation, then use it. But in this case one API user would be used to access Salesforce by many app user.

As another possible option take a look at OAuth 2.0 Web Server Authentication Flow. This would allow authenticate your app for each user (given that users have their own Salesforce accounts). And you don't need to store salesforce user credentials at all.

Explore the docs for more details about pros and cons of each flow and whether it suitable for your use case or not.

Improve this answer
3
  • In my app the user never logs into SalesForce, he logs into my app. My app always has a token stored which it uses to access SF Restful API.
    – Airwavezx
    Commented Jul 22, 2018 at 10:22
  • To use Salesforce API from your app you definitely need an access token. An access token can be obtained in exchange for user login/password (I just simplified here). So obviously you need a Salesforce user called an API user. For your scenario you can utilize OAuth 2.0 Username-Password Flow to get an access token, which I think you already use? Users of your app will never be asked to login into SF.
    – Eduard
    Commented Jul 22, 2018 at 10:30
  • Yes, exactly! Is the flow I'm using correct? Or is there a more suitable way to access SF API for my case?
    – Airwavezx
    Commented Jul 22, 2018 at 10:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .