I have an Apex class that is consuming a partners REST webservices. Currently all users of my app (in the installed org) access the service via a single API Integration user.

We now want make the REST reponse dependant on the Users permissions, so the external REST service needs to know a Users role.

Passing the role as part of the request is not safe so we though about SAML and Signle Sign on Auth Flows as described here: https://developer.salesforce.com/docs/atlas.en-us.sso.meta/sso/sso_about.htm

The external service could know about each consuming user from the salesforce side. I don't know how, but maybe Salesforce could transparently log the Salesforce user in when creating a webservice call.


The solution would depend on how your partner's web service intends to consume your request with user roles/permissions. Even if the target service supports a standard protocol with a defined token format (e.g. oAuth with JWT or SAML Bearer flow), stuffing user roles/permissions into the token is not specified in a standard so it'll have to be engineered on both sides. Possible but complicated, especially on the service side.

Sending data to the partner service using a proprietary interface is your best option. POSTing the data in a HTTP request body over SSL is considered safe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.