We want to allow users who are already logged into salesforce and have access to our application to continue to our application home page without going through the login flow , if not we want to take them through login flow where we use Web Server OAuth Authentication Flow to log them in, It will be of great help if you could please guide on how we could go about achieving this

closed as too broad by glls, sfdcfox, battery.cord, David Reed, Dave Humm Jul 29 '18 at 22:11

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


There are several means of doing this. The easiest, which is the one I'd recommend, would be to create a link to your application as a Connected App from Salesforce. In addition to that link, see Defining Connected App in the REST API Docs.

You don't say whether you have SSO enabled and if so, who your idP is. If you do, you'll have other options including Oauth protocols using JS and REST.


In response to comments...

This is my understanding of how it should work:

When you created your Connected App, there should have been a clientId and a consumerSecret. Using Base64Encoding, these are combined to generate a refresh token by Salesforce for the Connected App. The OAuth flow is an idS initiated flow (I say that because the call to the connected app is generally initiated by by the Salesforce org/instance with Salesforce (all of Salesforce.com) acting as the idP). The expiration of the refresh token is also configured in the Connected App settings. See Edit Connected App Behavior in Salesforce Help.

Your app should have these two things:

  • Start URL—For connected apps that use single sign-on. Set the URL to the page where the user starts the authentication process.
  • Mobile Start URL—For mobile connected apps to direct users to a specific location when the app is accessed from a mobile device.

Using OAuth, you should be able to check for the refresh token of a user who's visiting your app. What's below is part of what you'll find in the documentation.

The Refresh Token policy determines whether a refresh token is provided during authorization to get a new access token. If refresh tokens are provided, users can continue to access the OAuth-enabled connected app without having to reauthorize when the access token expires. Admins limit the lifetime of access tokens with the session timeout value. The connected app exchanges the refresh token with an access token to start a new session. A Salesforce admin can choose one of the following refresh token policies.

  • Refresh token is valid until revoked—Default. The refresh token is used indefinitely, unless revoked by the user or Salesforce admin. You revoke tokens on a user’s detail page under OAuth Connected Apps or on the OAuth Connected Apps Usage Setup page.
  • Immediately expire refresh token—The refresh token is invalid immediately. The user can use the current session (access token) already issued, but can’t obtain a new session when the access token expires.
  • Expire refresh token if not used for n—The refresh token is valid as long as it’s been used within a specified amount of time. For example, if set to seven days, and the refresh token isn’t exchanged for a new session within seven days, the next attempt to use the token fails. The expired token can’t generate new sessions. If the refresh token is exchanged within seven days, the token is valid for another seven days. The monitoring period of inactivity also resets.
  • Expire refresh token after n—The refresh token is valid for a fixed amount of time. For example, if th e policy states one day, the user can obtain new sessions only for 24 hours.
  • Thank you for your answer ! our app is on-boarded on to salesforce as a connected app, but we are not sure how would be able to see if the user is already logged into salesforce before visiting our saas application if you could please guide us how to achieve that would be of great help – user2359997 Jul 27 '18 at 20:21
  • @user2359997 See my edited answer. I hope this answers your question on how to proceed with your OAuth implementation. – crmprogdev Jul 28 '18 at 14:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.