17

Salesforce can use a SSL certificate to authenticate itself with a third party server, but can a third party server authenticate with a Salesforce in the same manner? Our use case is that we have legacy apps that use non-authenticated REST calls, with a mediator that redirects those devices to the correct endpoint, such that the legacy apps do not need to ever have their configuration updated directly. We would like to be able to authenticate as a user and access custom REST web service methods without having to supply a username, password, or token, but still have the client authenticated by way of a SSL certificate, simply by installing the appropriate certificate.

  • According to the "Certificate & Key Management" page (Setup->Security Controls->Certificate & Key Management), "Mutual authentication certificates are used when an HTTPS request is made to a salesforce.com organization from a third-party service on a specified port. Contact your salesforce.com support representative to enable this feature." I've not used this (hence a comment instead of an answer), but it sounds like what you are looking for? Edit: found docs.releasenotes.salesforce.com/en-us/winter14/release-notes/… with more info. – Jason Clark Feb 13 '14 at 16:41
  • I'm surprised I missed this. I'll look into it. – sfdcfox Feb 13 '14 at 18:45
  • @sfdcfox I was about to post a question about this - did you ever get any further with the link that Jason posted? The release notes don't make much sense to me, especially how the calls are tied to a specific user. – James Jul 29 '14 at 15:59
  • According to the documentation at help.salesforce.com/apex/…, the user still has to make a call to the login() SOAP method with the username and password to get a session token. Seems to up the security level at least, but doesn't negate the need for username / password. – James Jul 29 '14 at 16:23
  • I'm a little confused about the ask. It's unclear to me what you mean by authentication. If you're only concern is that an "authorized" client is accessing an "authorized" server, then 2-way SSL is the path to go. Instead, if you're looking for the client to provide some kind of user credential so the server can run under the privileges of a user, you may want to explore JWTLogin <doingpoorly.blogspot.com/2014/11/…> – tggagne Jan 12 '15 at 17:15
2

If I understand you correctly, you want to make web service callouts from Salesforce org to your legacy apps behind the mediator. You will only need Two-Way SSL when making web service callouts from Salesforce org to external systems. See Making Authenticated Web Service Callouts Using Two Way SSL. You can install Apache HTTP server on your mediator and use it as a revers proxy to delegate requests to appropriate legacy apps. The Apache HTTP server deals with SSL configuration. You will need to install your external system's domain certificate on Apache server. Also you need to generate the certificate for Salesforce on the Apache server and upload the certificate back to the Salesforce org.

  • The other way around, actually. Legacy apps through mediator to salesforce.com. I found how to use SSL with other servers, but salesforce isn't going to be initiating the requests. – sfdcfox Feb 20 '14 at 17:27
  • So you are thinking to make certificate signing request to Salesforce and expect Salesforce to have a mechanism to generate the certificate so that you can install this certificate on your legacy system and then use it to communicate to Salesforce org without providing user name and password. I don't think Salesforce would like to do this. For one, Salesforce is not a Certificate Authority. Secondly, it would be much more difficult to recover if you lose the certificate than username/password. Last, it would be huge maintenance work on Salesforce. – user6941 Feb 20 '14 at 17:51
  • I'm working with salesforce.com re: the comment on the question about using SSL certificates, actually, but we may end up going with SAML, which I found out was an option after posting the question. I do appreciate the answer here, though. – sfdcfox Feb 20 '14 at 18:02
  • @sfdcfox any luck on this? similar scenario- third party needs to make unauthenticated call to SF rest endpoint exposed through public site. they can however provide a certificate in their call. looking for a way in apex to validate their incoming certificate – nickforce Nov 16 '17 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.