6

Is it possible to log in from sfdx CLI to already existent sandbox having username/password combination?

Reading through documentation I see bunch of ways how to authorize - through browser, by providing JWT token and consumer key, using existent access token etc. But cannot find a simple way how to do it in a browserless way just by providing username & password right in command line.

We just need to deploy code and run tests against our qa sandbox from CI pipeline - need to authorize an org somehow without human being involved. Is there a simpler way than following whole JWT authorization flow, i.e. creating connected app on each sandbox, upload certificate etc.

Any help would be appreciated.

7

sfdx force:auth only provides the JWT and web OAuth login methods:

sfdx force:auth commands: (get help with sfdx help force:auth:COMMAND)
 force:auth:jwt:grant      authorize an org using the JWT flow
 force:auth:logout         log out from authorized orgs
 force:auth:sfdxurl:store  authorize an org using an SFDX auth URL
 force:auth:web:login      authorize an org using the web login flow

But... there's a couple of different ways around the lack of a direct username/password login option.

One's to use sfdx force:source:convert to build a Metadata API package. Provided you have configured your sandbox so that CLI access doesn't require completing the verification code (or you're logging in with a security token), you can then use any existing Metadata API deployment tool (Force.com Migration Tool, Force.com CLI, etc) to perform the deploy using the username and password alone.

Another route is to login to the sandbox by hand once, locally, via force:auth:web:login. Then do sfdx force:org:display -u <username> --verbose to get the SFDX authentication URL, which starts with force:// and includes the OAuth refresh token (not the session id). You can store that securely in an encrypted file and later load it into SFDX with sfdx force:auth:sfdxurl:store -f <thefile>. (Credit to CRMScience for documenting this approach).

  • That's basically what we are doing now, i.e. using ant migration tool for deployment/test/apex execution and also selenium scripts to trigger some actions like package upload and installation. I was hopping to switch to sfdx CLI as a more reliable and consistent way of doing all that things. Suggested approach with auth url & refresh token doesn't look simpler than JWT + connected app, as for me. Probably would go ahead with JWT flow using the same certificate for all sandboxes to keep thinks simpler. Thanks. – wesaw Aug 6 '18 at 18:01
  • 1
    I confirm the jwt approach + same certificate on all orgs , we use that and it works well :) Before calling the jwt grant, I suggest to call force:org:list --json and parse the response to see if it is necessary – Nicolas Vuillamy Aug 7 '18 at 2:12
  • wish someone would write a plugin to do this.. It makes it a real pain when someone else references a sandbox and you can't get an confirmation code due to the email botching. The only way to login is with the security token – NSjonas Mar 8 at 8:24
  • @NicolasVuillamy can you that on sandboxes too via jwt? – Edmondo1984 May 8 at 16:24
  • @Edmondo1984 we use JWT login with developer and enterprise orgs , so I think that it should work too with sandboxes ( if you configured the related connected app ), but as we don't use sandboxes I have never experienced it myself – Nicolas Vuillamy May 10 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.