Username Password Auth Flow returning different response than expected

Question

I'm trying to get the access token using Salesforce Username/Password OAuth flow. I have created a connected app, provided full access in the Oauth scopes and pre-authorized System Admin profile users. I'm sending a POST request in Salesforce and added all the query parameters client_id, client_secret, username, password, grant_type. I was expecting the response body to contain the access token but ended up getting html content. Am I doing something wrong somewhere?? I thought this OAuth flow is pretty straight forward.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" style="visibility: visible;" lang=en-us xml:lang=en-us>
    <head>
        <meta name="viewport" content="initial-scale=1.0"/>
        <meta name="description" content="Salesforce Customer Secure Login Page. Login to your Salesforce Customer Account." />
        <title>Login | Salesforce</title>
        <meta name="format-detection" content="telephone=no" />
        <link rel="stylesheet" type="text/css" href="/css/sfdc_210.css" />
        <style type="text/css">html{visibility: hidden;}a{color:#0070d2;}body{background-color:#F4F6F9;}#content,.container{background-color:#ffffff;}#header{color:#16325c;}body{display: table; width:100%;}#content{margin-bottom:24px;}#wrap{height:100%;}</style>
        <style type="text/css"> html { visibility: hidden; } </style>
        <script type="text/javascript">if (self == top) {document.documentElement.style.visibility = 'visible';} else {document.write = ''; top.location = self.location; setTimeout(function(){document.body.innerHTML='';}, 1);window.self.onload=function(evt){document.body.innerHTML='';};}</script>
        <script>var SFDCSessionVars={"server":"https:\/\/login.salesforce.com\/login\/sessionserver212.html","im":false,"ah":"active","save":"Save","saveOne":"Save 1 Change","sum":"#p# Saved Usernames","iaac":false,"hac":"Choose a Username","suo":"1 Saved Username","title":" | Salesforce","saveMany":"Save #p# Changes","lpt":"Login","lllbl":"Lightning Login","host":"login.salesforce.com","le":false,"heu":"Edit Username List","ic":false,"lh":false,"hidp":"Log In Using","ih":"inactive","dc":"Username removed. Click Save to Commit Changes."};</script>
        <script src="/jslibrary/SfdcSessionBase208.js"></script>
        <script src="/jslibrary/LoginHint208.js"></script>
        <script>LoginHint.hideLoginForm();</script>
        <link rel="canonical" href="https://login.salesforce.com/?locale=us"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=nb-no" hreflang="nb-no"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=de" hreflang="de"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=tw" hreflang="zh-Hant-tw"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=ru" hreflang="ru"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=fi" hreflang="fi"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=jp" hreflang="ja-jp"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=fr" hreflang="fr"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=br" hreflang="pt-br"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=se" hreflang="sv"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=uk" hreflang="en-gb"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=ca" hreflang="en-ca"/>
        <link rel="alternate" href="https://login.salesforce.com" hreflang="en-us"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=in" hreflang="en-in"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=en-hk" hreflang="en-hk"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=kr" hreflang="ko-kr"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=cn" hreflang="zh-Hans-cn"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=mx" hreflang="es-mx"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=it" hreflang="it"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=fr-ca" hreflang="fr-ca"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=es" hreflang="es"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=ap" hreflang="en-sg"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=eu" hreflang="en"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=th" hreflang="th"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=au" hreflang="en-au"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=da-dk" hreflang="da-dk"/>
        <link rel="alternate" href="https://login.salesforce.com/?locale=nl" hreflang="nl"/>
    </head>
    <body onload="lazyload();">
        <div id="left" class="pr">
            <div id="wrap">
                <div id="main">
                    <div id="wrapper">
                        <div id="logo_wrapper" class="standard_logo_wrapper mb24">
                            <h1 style="height: 100%; display: table-cell; vertical-align: bottom;">
                                <img id="logo" class="standard_logo" src="/img/logo214.svg" alt="Salesforce" border="0" name="logo">
                            </h1>
                        </div>
                        <h2 id="header" class="mb12"></h2>
                        <div id="content">
                            <div id="chooser" style="display: none">
                                <div class="loginError" id="chooser_error" style="display:none;"></div>
                                <div>
                                    <span id="chooser_label" class="label"></span>
                                    <a href="javascript:void(0);" id="edit" class="fr small" onclick="LoginHint.showEdit();">Edit List</a>
                                </div>
                                <div class="scrollable mt8">
                                    <ul id="idlist"></ul>
                                </div>
                            </div>
                            <div id="manager" style="display: none">
                                <div class="nonscrollable mt8">
                                    <ul id="editlist" class="mb24" aria-live="polite" aria-relevant="additions removals"></ul>
                                </div>
                                <div class="mt16">
                                    <button class="button primary fiftyfifty right" id="hint_save_edit" name="Save" onclick="LoginHint.saveHintEdit();">Save</button>
                                    <button class="button secondary fiftyfifty" id="hint_back_edit" name="Cancel" onclick="LoginHint.showChooser();">Cancel</button>
                                </div>
                            </div>
                            <div id="theloginform">
                                <form name="login" method="post" id="login_form" onsubmit="handleLogin();" action="https://login.salesforce.com/" target="_top" autocomplete="off" novalidate="novalidate">
                                    <input type="hidden" id="pqs" name="pqs" value="?grant_type=password&amp;client_id=3MVG9QBLg8QGkFerS4zTdoCnaDOPl5Qm6KEYMSYQT.eNLlQpt9ox.0fG6R8tHAESMKKBlbf2b4ql_hWZbskgu&amp;client_secret=4869032460675835042&amp;username=pkonda%40cardlytics.com.dev&amp;password=AppleJack_2019"/>
                                    <fieldset style="display:none">
                                        <input type="hidden" name="un" id="un_hfid" value="" />
                                        <input type="hidden" name="width" value="" />
                                        <input type="hidden" name="height" value="" />
                                        <input type="hidden" name="hasRememberUn" value="true" />
                                        <input type="hidden" id="login_startUrl" name="startURL" value="" />
                                        <input type="hidden" name="loginURL" value="" />
                                        <input type="hidden" name="loginType" value="" />
                                        <input type="hidden" name="useSecure" value="true" />
                                        <input type="hidden" name="local" value="" />
                                        <input type="hidden" name="lt" value="standard" />
                                        <input type="hidden" name="qs" value="" />
                                        <input type="hidden" name="locale" value="" />
                                        <input type="hidden" name="oauth_token" value="" />
                                        <input type="hidden" name="oauth_callback" value="" />
                                        <input type="hidden" name="login" value="" />
                                        <input type="hidden" name="serverid" value="" />
                                        <input type="hidden" name="QCQQ" value="null" />
                                        <input type="hidden" name="display" value="page" />
                                    </fieldset>
                                    <div id="usernamegroup" class="inputgroup">
                                        <label for="username" class="label usernamelabel">Username</label>
                                        <div id="username_container">
                                            <div id="idcard-container" class="mt8 mb16" style="display: none">
                                                <div id="idcard">
                                                    <img id="idcard-avatar" class="avatar" alt="">
                                                    <a href="javascript:void(0);" id="clear_link" class="clearlink" onclick="LoginHint.clearExistingIdentity();">
                                                        <img alt="Log In with a Different Username" class="clearicon" src="/img/clear.png">
                                                    </a>
                                                    <span id="idcard-identity"></span>
                                                </div>
                                            </div>
                                            <input class="input r4 wide mb16 mt8 username" type="email" value="" name="username" id="username" aria-describedby="error">
                                        </div>
                                    </div>
                                    <label for="password" class="label">Password</label>
                                    <input class="input r4 wide mb16 mt8 password" type="password" id="password" name="pw" onkeypress="checkCaps(event)" autocomplete="off"/>
                                    <div id="pwcaps" class="mb16" style="display:none">
                                        <img id="pwcapsicon" alt="Caps Lock is on." width="12"/> Caps Lock is on.
                                    </div>
                                    <input class="button r4 wide primary" type="submit" id="Login" name="Login" value="Log In" />
                                    <div class="w0 pr ln3 p16 remember">
                                        <input type="checkbox" class="r4 fl mr8" style="" id="rememberUn" name="rememberUn">
                                        <label for="rememberUn" class="fl pr db tn3">Remember me</label>
                                        <br>
                                    </div>
                                </form>
                                <div class="w0 links bt pt16 mb20">
                                    <a id="forgot_password_link" class="fl small" href="/secur/forgotpassword.jsp?locale=us&lqs=grant_type%3Dpassword%26client_id%3D3MVG9QBLg8QGkFerS4zTdoCnaDOPl5Qm6KEYMSYQT.eNLlQpt9ox.0fG6R8tHAESMKKBlbf2b4ql_hWZbskgu%26client_secret%3D4869032460675835042%26username%3Dpkonda%2540cardlytics.com.dev%26password%3DAppleJack_2019">Forgot Your Password?</a>
                                    <a id="mydomainLink" class="fr small" href="javascript:void(0);" onclick="DomainSwitcher.enterCustomDomain('Use Custom Domain',' | Salesforce')">Use Custom Domain</a>
                                </div>
                            </div>
                            <div id="mydomainContainer" style="display:none;">
                                <p class="mb16">To go to your company's login page, enter the custom domain name.</p>
                                <form onsubmit="DomainSwitcher.handleMyDomain();return false;">
                                    <label for="mydomain" class="label">Custom Domain</label>
                                    <input type="text" class="input wide focus mt8 mb16" name="mydomain" id="mydomain" onkeyup="DomainSwitcher.updateMyDomain(this, event);"/>
                                    <div id="mydomain_preview" class="mb16 wordwrap">https://
                                        <em>domain</em>.my.salesforce.com
                                    </div>
                                </form>
                                <input type="hidden" id="mydomain_suffix" value=".my.salesforce.com"/>
                                <input type="hidden" id="community_suffix" value=".ap3.force.com"/>
                                <button class="button primary fiftyfifty right" id="mydomainContinue" name="Continue" onclick="DomainSwitcher.handleMyDomain();">Continue</button>
                                <button class="button secondary fiftyfifty" id="hint_back_domain" onclick="DomainSwitcher.dismissCustomDomain('Login',' | Salesforce');">Back</button>
                            </div>
                        </div>
                        <div id="signup" class="tc mt24">
                            <p class="di mr16">Not a customer?</p>
                            <a class="button secondary" id="signup_link" href="https://www.salesforce.com/form/trial/freetrial.jsp?d=70130000000Enus">Try for Free</a>
                        </div>
                        <div class="tc" id="use_new_identity_div" style="display:none;">
                            <a id="use_new_identity" href="javascript:void(0);" onclick="LoginHint.useNewIdentity();">Log In with a Different Username</a>
                        </div>
                    </div>
                </div>
            </div>
            <div id="footer">&copy; 2019 salesforce.com, inc. All rights reserved. | 
                <a id="privacy-link" href="https://www.salesforce.com/us/company/privacy" target="_blank">Privacy</a>
            </div>
        </div>
        <div id="right">
            <iframe frameborder="0" src="/s.gif" id="marketing" name="marketing" scrolling="no" title="Marketing" tabindex="-1"sandbox="allow-forms allow-pointer-lock allow-popups allow-same-origin allow-scripts" ></iframe>
        </div>
        <div aria-live="polite" aria-atomic="true" class="zen-assistiveText" style="width:0px;height:0px;" id="assistive-announce">Login</div>
        <script>LoginHint.getSavedIdentities(false);</script>
        <script src="/jslibrary/baselogin4.js"></script>
        <script src="/jslibrary/LoginMarketingSurveyResponse.js"></script>
        <script type="text/javascript" src="/marketing/survey/survey1/1380"></script>
        <script type="text/javascript" src="/marketing/survey/survey4/1380"></script>
        <script>function handleLogin(){document.login.un.value=document.login.username.value;document.login.width.value=screen.width;document.login.height.value=screen.height;}function lazyload(){document.getElementById("pwcapsicon").src="/img/icon/capslock_blue.png";document.getElementById("marketing").src="https://c.salesforce.com/login-messages/promos.html";}loader();</script>
    </body>
</html>

I'm using this "login.salesforce.com/services/oauth2/token". I did not find anything different for Sandbox so using the same — Prudhvi Konda, May 21, 2019 at 18:23
Is this sandbox (as you have mentioned)? If yes, then you need to use test.salesforce.com instead of login.salesforce.com — Jayant Das, May 21, 2019 at 18:24
Can you edit your question and provide the complete request details? Make sure not to expose any credentials. — Jayant Das, May 21, 2019 at 18:27

PartOfTheOhana · Accepted Answer · 2019-05-21 19:39:41Z

0

Below s what your POST request should look like.Please note the password might need the password+token concatenated:

Endpoint: https://XXXXX.my.salesforce.com/services/oauth2/token

Request Body:

client_id: lorem-ipsum-a
client_secret: lorem-ipsum-b
username: lorem-ipsum-c
password: lorem-ipsum-d //**NOTE YOU MIGHT NEED TO DO PASSWORD+TOKEN**
grant_type:password

edited May 21, 2019 at 19:39

answered May 21, 2019 at 18:49

PartOfTheOhana

10.5k13 gold badges88 silver badges178 bronze badges

They are not headers.
– sfdcfox
May 21, 2019 at 19:35
no, they are definitely not headers. thanks for catching that
– PartOfTheOhana
May 21, 2019 at 19:40

Add a comment |

sfdcfox · Accepted Answer · 2019-05-21 19:40:51Z

You need to pass in your parameters in the body. The request going over the wire should look like this:

POST /services/oauth2/token HTTP/1.1
Host: login.salesforce.com
Content-Length: ###
Content-Type: application/x-www-form-urlencoded
Accept: application/json

grant_type=password&username=abc%40xyz.com&password=mysecretpassword&client_id=####&client_secret=####

All parameters must be encoded, Content-Length must be correct, Content-Type is optional. If you are using the query string, the request will be invalid. It must be in the body of the request. Also, double-check that the URL is correct, as this may cause problems.

Please check the documentation for additional information.

Stack Exchange Network

Username Password Auth Flow returning different response than expected

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
oauth2
restresource
.

Hot Network Questions

Username Password Auth Flow returning different response than expected

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged oauth2restresource.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
oauth2
restresource
.