2

Till now, I have been working with SFDX orgs using JWT cert based auth auth:jwt:grantor authenticating using browser using auth:web:login

I recently came across the --verbose attribute which gives the additional Sfdx Auth Url which has the value in format of

force://<clientId>:<clientSecret>:<refreshToken>@<instanceUrl>

I am not sure how or why this attribute is used and i couldnt find any documentation on them other than saying its used for authentication. Can someone give some details or example of how to use this attribute and how it is useful

enter image description here

11

The SFDX URL can be used to authenticate to the Salesforce CLI without needing any JWT Token or using the browser to key in the credential.

In fact it is the easiest way to authenticate through CLI. Let me explain how salesforce CLI authenticates today.

The first time when you log in via the CLI, you go to the salesforce login screen and key in credentials (if you are not using JWT flow. For JWT the certificate takes care of it).

What happens next time when you do a sfdx force:org:open? It does not ask for the credential and instead, you log in straight.

How does this happens?

Salesforce stores the access token and refreshes token (It got to also has clientId and client secret of the connected app somewhere too) the first time and then uses it for the subsequent requests. You can go to the $HOME directory of your computer and cd into the .sfdx folder to see for every org there will be a .json file having some information which I am sure will be fun for you.

Use your local computer and authenticate to as many orgs you need to login and note its sfdx url and use it in the CI system without having to worry about JWT tokens and connected app.

CI system (which is headless) can easily log in using an auth:sfdxurl:store. Look into the docs here for more.

All you have to do in your CI once you have sfdx auth url is sfdx force:auth:sfdxurl:store -f <file containing sfdx auth url>

You do this using below

echo $SFDXURL_HUB > /tmp/sfdx.url

sfdx force:auth:sfdxurl:store -f /tmp/sfdx.url -a circle_build_$CIRCLE_BUILD_NUM --setdefaultdevhubusername

$SFDXURL_HUB is the environment variable I am assuming to have the sfdx URL

Security Considerations

One of the reasons why salesforce does not speak much about this in docs is security. You can shoot yourself in foot with this if you expose the client secret and clientId like that.

So care should be taken to either store this sfdx auth url in an environment variable that cannot be easily reached except for someone with access.

Or use a technique like an open SSL shown here to encrypt it.

3
  • Interesting Mohit, i never knew we had such cool option. So if i share sfdx.url file between laptops, will they be able to use the same Auth Url and login in different laptops? I am wondering if i can share this file between our dev teams so our teams can login across scratch orgs. Will it work? I already encrypt all the server.key using openssl so i am thinking why not encrypt the SFDX.url instead and avoid JWT login. Is that something you do too? Sep 7 '19 at 17:52
  • Yes they will be able to login successfully.Yes avoid JWT .It's just a hassle to create connected app and then install that app and give the perms .Note that as long as you can securely share the auth url you are fine . Sep 7 '19 at 17:54
  • 1
    thanks Mohit..as always 👍 Sep 7 '19 at 20:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.