OAuth 2.0 handshake for Portal users

Question

As described on OAuth for portal , initial OAuth handshake for authorization code gathering is changed. It should be used different domain URL Like, instead of :

• https://login.salesforce.com/services/oauth2/authorize

it should be used :

• https://mysite.secure.force.com/services/oauth2

This is clear. It is not clear for me whether or not should be changed second OAuth 2.0 handshake step. When integrated app is asking for access&refresh tokens with provided authorization code. This link looks like :

• https://login.salesforce.com/services/oauth2/token

Should be changed with :

• https://mysite.secure.force.com/services/oauth2/token

or not ?

Answer 1

Second OAuth 2.0 call, obtain access and refresh tokens, remains as it was used for standard salesforce.

Note : It is important to be careful when doing log off from Portal. User should be moved from both domains - standard salesforce domain and portal specific domain. If this was not set, user will be logged off only from standard domain. This results with the case that next user that is logged from the same browser on the connected app will have same user's URI.