0

I want to know the process of authorization or authentication using self-signed certificates.

I am trying to integrate two salesforce dev orgs using REST callouts. I have created a self-signed certificate (named: 'TestCertificate') under certificate and key management section, exported it to keystore (.jks file generated) in one org say 'Org A' and imported the same .jks file in another org say 'Org B'.

Now i am trying to callout from org A to org B using http. below is the code snippet:

HttpRequest httpReq = new HttpRequest();
httpReq.setMethod('GET');
httpReq.setEndpoint('https://login.salesforce.com/services/data/v43.0/sobjects/account/describe');
httpReq.setClientCertificateName('TestCertificate');
Http http = new Http();
HttpResponse response = http.send(httpReq);

(I have used my dev org domain name instead of login.salesforce.com). In response i am getting 401, Unauthorized error.

Could someone help with the process of authorization with certificates? is there any other details needs to be passed in the header? or How does certificates authorization works?

  • What are you trying to do ? 2-way SSL? I don't think you need to do that if you are integrating 2 Salesforce orgs. If you have created a certificate in Org A, just call from Org B with https as the endpoint. – Jarvis Aug 14 '18 at 10:05
  • No, i am not trying 2 way SSL. i am just trying to integrate 2 sfdc orgs. I have tried calling org A from org B using the code snippet I mentioned, but i am getting Status code 401 , Unauthorized error. – Ankur Gupta Aug 14 '18 at 10:09
  • comment httpReq.setClientCertificateName('TestCertificate'); and try – Jarvis Aug 14 '18 at 10:13
  • Its already there in the code i have given. – Ankur Gupta Aug 14 '18 at 10:15
  • I said remove/comment it. Please read the comment again. – Jarvis Aug 14 '18 at 10:16
1

I do not believe that setClientCertificate() is used for what you are trying to use it for.

From the HttpRequest class documentation

setClientCertificateName(certDevName)

If the external service requires a client certificate for authentication, set the certificate name.

Authentication with Salesforce can make use of a certificate, but a certificate alone is insufficient.

When you're using a Salesforce API like the REST API, even if you're trying to make an API call to the same org you are making the API call from, you're executing some action on behalf of a user. A certificate alone doesn't tell Salesforce which user to execute the action as. Without a user, Salesforce couldn't apply any access controls to objects/records, fields, visualforce pages, etc...

To do what you're trying to do (API integration between two orgs), you'll need to authenticate as a user in the org you are making the API callout to by using a connected app and an oAuth2.0 flow.1

For inter-org integration, I believe the JWT-Bearer flow is the most appropriate because it can be configured to not require a browser to log in (like pretty much every other flow requires) after initial setup.

1: This isn't the only way to do this, but the alternative is such bad practice that it's not even worth mentioning

  • Thanks @Derek , so is it possible to integrate with external system i.e salesforce to third party application using these much line of code which i used as per snippet in question ? Could you please explain the steps or process to integrate salesforce and third party system using certificates, as i am not able to find any concrete example which works end to end for this? – Ankur Gupta Aug 14 '18 at 13:27
  • @AnkurGupta Possible? perhaps, but unlikely. It depends on the third party. Most of my integrations have involved an OAuth flow, others have relied on a simple Authorization: Basic <base64 value here> scheme. Whatever third-party service you're using, they should provide you with documentation about how you need to authenticate to use the service. They probably won't have instructions specific to Salesforce, but it's fairly simple to "translate" to apex (usually, set some headers, set the http method, set the endpoint, make the callout, parse the result). – Derek F Aug 14 '18 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.