We are building a Mobile App (using React Native) which will allow users (of Persona-A) to login via External Identity Provider. We have another set of users (Persona-B) who login to Salesforce Custom LEX App.
Requirement: We need to establish integration between Mobile App and Salesforce, so that Persona-A users can send/transfer the data to Salesforce which Persona-B users can review & confirm. We have created Custom Apex REST Services in Salesforce which will be used by Mobile App to send data. Persona-A will never login to Salesforce.
**Solution:**We are thinking of 2 approaches to implement this: Approach.1: Create a Secure API Only User in Salesforce and use this user account to transfer data from Mobile App to Salesforce. Only way we could do this is by creating a Connected App, establishing an OAuth connection by storing the credentials of this API user in the Mobile App config file.
Approach.2: Create a Public Site in Salesforce and expose the APEX REST services through this site. Once user login to Mobile App (after authentication with ExtIdP), when they send data to Salesforce, we trigger the REST callout to Salesforce Public Site. To make sure that Public Site is receiving request from valid source, Mobile App will send the "OAuth Token" and "Username" in every REST Callouts, and Salesforce Apex REST class will authenticate the request this agains the ExtIdp, before proceeding with further processing.
Here are my questions:
- In Approach.1, is this approach is in violation of Master Subscription Agreement or against License Compliance?
- In Approach.2, is there any way to connect with Salesforce via Secure API Only User without using the OAuth Username-Password Flow?
- Any particular concept I should be aware of about the Approach.2?