1

I have a requirement where some external web forms would be calling our REST API to submit Lead. I have created a connected app, got the consumer id and consumer secret. I want my apex class to be accessible only to those people who have the consumer key and consumer secret. In other words, the lead should only be created if the incoming request has consumer key and consumer secret.

This is my code right now:

@RestResource(urlMapping='/api/createLead')

global with sharing class RESTAPI_JSONPayload 
{


@HttpPost
global static void doPost() {
  RestRequest req = RestContext.request;
  Blob body = req.requestBody;
  String requestString = body.toString();
  String ContentType = RestContext.request.headers.get('Content-Type') ;
//Now as you have the request string You can parse it in APEX

  JSON2Apex rw = (JSON2Apex)JSON.deserialize(requestString,JSON2Apex.class);
  .......
  .......
  ........

Right now, I have been testing it with POSTMAN tool in 2 steps:

Making a POST request first with username, password, client_id, client_secret, grant_type to receive access token.

Then I make another POST request in POSTMAN to create a lead in Salesforce, using the access token I received before and the body.

Questions:

I wonder since I have not incorporated consumer key and consumer secret in my code above, how does that REST class got connected to my "Connected app" in Salesforce and the specific Consumer key and secret coming from the connected app?

Secondly, do I need to provide port number and callback url in my code above? Or whatever I have is fine?

0

I wonder since I have not incorporated consumer key and consumer secret in my code above, how does that REST class got connected to my "Connected app" in Salesforce and the specific Consumer key and secret coming from the connected app?

You need a valid "access token" to be able to access your API resources. And that you got this by authenticating and authorizing your connected app by using the combination of your consumer key/secret, username, etc. The API is not aware how you retrieved the "access token". So as long as you have one, you will be always be able to access your API.

Secondly, do I need to provide port number and callback url in my code above? Or whatever I have is fine?

The Callback URL is utilized in a Connected App to be able for Salesforce to send the access token to a particular location.

Depending on which OAuth flow you use, this is typically the URL that a user’s browser is redirected to after successful authentication. As this URL is used for some OAuth flows to pass an access token, the URL must use secure HTTP (HTTPS) or a custom URI scheme.

  • Thanks RedDevil and Jayant Das for the help. So regarding the first question, let's say if we have multiple connected apps created in our Salesforce. So in that case, if user has access to any of the consumer key or consumer secret, they would be able to submit lead request? I guess ideally, it should only be able to submit lead request/call this API when they know the consumer key and consumer secret only for that particular app. – Student May 15 at 19:11
  • 1
    You can get a token from any app. Apps are not too significant here, those are definitions in Salesforce as which external apps are connecting to Salesforce and what level of privileges will those apps have. Ultimately it's the User which authenticates to Salesforce. You cannot get access to Salesforce resources by just having a connected app. So as long as a User can authenticate to Salesforce (using different OAuth flows, in your case it was username/password), and acquire a token, they will be able to access the API. – Jayant Das May 15 at 19:16
  • ok. Regarding the callback url. So in my postman I am hitting this url first cs63.salesforce.com/services/oauth2/token to receive access token. Then I call the actual REST API. cs63.salesforce.com/services/apexrest/api/createLead to submit lead request. In my connected app, I have added this as callback url, test.salesforce.com/services/oauth2/callback does it seem right? – Student May 15 at 19:27
  • I will recommend you start from the docs on Connected App. That will give you the clarity on how it works. It will depend on where you want Salesforce to redirect the flow after successful authentication to be able to send the access token (depending on the OAuth flow). – Jayant Das May 15 at 19:29
0

The rest Class that you have created is for the business logic that needs to happen. Typically what happens when external vendors needs to invoke a rest service in salesforce is that, we create connected app in salesforce and based on the oAuth flow we choose we need to provide one of username/password/certificate along with client id/client secret to the vendor to invoke salesforce.

Only if this authentication passes you rest code will get invoked.

I wonder since I have not incorporated consumer key and consumer secret in my code above, how does that REST class got connected to my "Connected app" in Salesforce and the specific Consumer key and secret coming from the connected app?

You dont need to since the first step to access your rest resource is authorization using one of the oAuth flows for your connected App,Post which your target system gets a token which they use to access the rest resource, so no one other than the target system can get access to this rest resource(apex class)

Secondly, do I need to provide port number and callback url in my code above? Or whatever I have is fine?

You dont have to provide port number,based on the oAuth flow you choose you need to provide salesforce URL which the external vendor will use to get the token.

You should read about different oAuth flows to understand how they work and choose the most suitable one after discussion with your vendor

  • I am using username-password authentication flow. – Student May 15 at 19:14
  • 1
    @Student, This is the least recommended flow but if you still wish to use this what you could do is for the user profile you can add a custom permission and check only if this user has this permission (allow lead creation) then you continue with your code. if not you dont do anything – RedDevil May 15 at 19:15
  • So I need to set the permissions on profile level. There is no way to bound a specific connected app with the apex class. – Student May 15 at 19:18
  • 1
    @Student - Custom permissions are assigned through permission set to the user ,another trick you can do is to only give the user's profile access in the connected app that way others cannot access it. if you goto connected app you can add admin pre-authorized profiles so if you only give this users profile in the connected app others cannot get token through it – RedDevil May 15 at 19:20
  • Ahhh nice. I like that idea! – Student May 15 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.