1

I'm developing an application which integrates with another services API. This API requires a SAML token to provide authentication. I've created a connected app, and from an execute anonymous call if I invoke the idp url I get back a page which contains the SAML token which I can parse and use to authenticate against the API (if you perform a get against that URL and it detects you don't have javascript enabled which an HTTP request from apex doesn't, it instead provides a button to click that contains the SAML token)

The problem is that I cannot make a request to the connected app from within a visualforce page/lightning app context because the sessionId I get from the userinfo.getSessionId() I use to authorize the get request is only valid for the visualforce/lightning custom code domain, not the standard page domain. How can I make a get request to get the SAML token from the connected app from within my visualforce page, or is there a better way to do this? I feel like this approach is already very hacky, but I don't know of a better way to get the SAML token in Apex that I need to authorized against the endpoint and get an access token from them for further API calls against their API.

TL;DR: How do I make a get request against a standard salesforce page from a lightning component context? Using the Session ID provided by userInfo.getSessionId() does not work when run from within a lightning context, but does work in execute anonymous.

Here is the code for my request as it stands. Nothing too fancy, but just in case it helpds.

            //get the URL of the connected app that is stored in a custom meta data record
        req.setEndpoint(SETTINGS.Local_IdP_Initiated_Login_Url__c); //Idp Initiated Login URL
        req.setMethod('GET');
        string token = Userinfo.getSessionId();
        system.debug('Session ID: ' + UserInfo.getSessionId().substring(0,20) + ' --------- ' +UserInfo.getSessionId().substring(20,UserInfo.getSessionId().length()));
        String authorizationHeader = 'sid=' + token;
        req.setHeader('Cookie', authorizationHeader);
        //Tried setting authorization bearer, didn't work with any session token retreived
        //req.setHeader('Authorization', ' Bearer ' + token);
        Http http = new Http();
        HTTPResponse res = new HttpResponse();
        if(!Test.isRunningTest()) res = http.send(req);
        else res.setBody(SSOTestData.formResponse());

        system.debug('Request Body: ' + req.getBody());

        system.debug('\n\n----- SAML response body: ' + res.getBOdy());

        System.debug('\n\n----- Response Header Keys ' + json.serializePretty(res.getHeaderKeys()));
        for( String akey :res.getHeaderKeys()  )
        {
            system.debug('----- Key: ' + aKey + ' value ' + res.getHeader(aKey));
        }
        try
        {
            DOM.Document doc=new DOM.Document();
            doc.load(res.getBody());

            DOM.XmlNode rootNode=doc.getRootElement();
            string nodeValue = utilities.readXmlNode(rootNode,'SAMLResponse');

            accessToken = GetAccessTokenFromSAMLString(nodeValue);

            if(accessToken != null)
            {
                SaveTokenSetting(accessToken, dateTime.now(), TOKEN_VALID_MINS);
            }
        }
        catch(exception e)
        {
            log.addLog('GetIdpSaml', 'Unable to parse token response as XML. Assuming already logged in using existing session. ' +e.getMessage() + ' on line ' + e.getLineNumber() + '. Response body: ' +res.getBody());
        }
  • Could you use stored credentials to authenticate against the org as your connected app? One of the JS libraries might be handy on that front. – Matt Lacey Feb 28 at 3:54
  • Not sure about using stored credentials, do you have any sample code? I'm not quite sure I follow how that would work. – Kenji776 Feb 28 at 4:03
  • Are you trying to connect to a SFDC org from another SFDC org? – Sebastian Kessel Feb 28 at 4:41
  • @SebastianKessel I am trying to access a page within the same org but it is a standard page, and my code is of course custom, so the sessionId fetched on the custom code domain does not seem to be valid for the standard page domain. – Kenji776 Feb 28 at 4:47
  • This feels like an xy problem. Can you describe what problem led you to attempt to authenticate against the org you’re currently in? – Sebastian Kessel Feb 28 at 4:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.