0

I want generate a token, give this token to third-party application, and this app can authentificate into salesforce and call the web service.

I want to create an authentication token, call a third application where I will send this token, and this third application can call my webservice and can enter into salesforce thanks to the token. Is all this necessary?

I created an connected app, and now I generate a token:

HttpRequest req = new HttpRequest();
req.setMethod('POST');
req.setHeader('Content-Type','application/x-www-form-urlencoded');
req.setEndpoint('https://test.salesforce.com/services/oauth2/token');

String CLIENT_ID = 'XXXXXXXXX';
String CLIENT_SECRET = 'XXXXXXXXX';
String USERNAME = 'XXXXXXXXX';
String PASSWORD = 'XXXXXXXXX';

req.setBody('grant_type=authorization_code' + '&client_id='+CLIENT_ID + 
            '&client_secret='+CLIENT_SECRET + '&username='+USERNAME + '&password='+PASSWORD);

Http http = new Http();
HTTPResponse response = http.send(req);
System.debug('Body ' + response.getBody());
System.debug('Status ' + response.getStatus());
System.debug('Status code ' + response.getStatusCode());

Now, with this token, the third application can call to the wb created ?

thanks Regards

2
  • Yes the third party can call your webservice with that token. I wonder why cant webserice get the access token and relies on you to send one? – Pranay Jaiswal Apr 15 '19 at 16:27
  • The system will work in the following way: We call the third application, passing some data, where the user will be redirected, when the user finishes working in the other application, he will send the processed data to our SFDC. My idea was to send the token on the first call to make authentication easier. – Rodolfo Apr 16 '19 at 7:08
1

I will try to answer your question starting from last one.

Now, with this token, the third application can call to the wb created ?

The answer to this is Yes. As long as the third (party) application has the access token, they can call the web service.

Now, coming to this question:

I want to create an authentication token, call a third application where I will send this token, and this third application can call my webservice and can enter into salesforce thanks to the token. Is all this necessary?

In an ideal state - this is not the correct approach. You will always want any connecting application to call the token endpoint to get the authorization token and then make any subsequent web service calls with that token, all by themselves and not relying for you to generate a token and send it to them for further consumption.

Why?

  1. Because using this approach you necessarily follow the OAuth 2.0 protocol flow where a client is responsible to operate on this flow.

  2. Additionally in your case you will provide the access token based on the authorization the user you are using to generate the token has, instead of what you would have wanted the external application to have. Remember, by default Apex Web Services don't have security implemented, you will need to make sure you implement the security based on the User calling the web service. And if you let your third party application call the token endpoint and then make the web service call, you will have much more control in that way.

2
  • thanks for the reply. My idea is not the best practice, so, how can the third application call my SFDC, get the token, authenticate and call the wb? I have everything ready, but I need to join the pieces. – Rodolfo Apr 16 '19 at 7:03
  • If you have everything ready, then your third party application to be able to call your web services will need to authenticate --> get token --> utilize the token to call the web services. I will recommend you take a look at this trailhead and the docs for more information around invoking web services in SF. – Jayant Das Apr 16 '19 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.