We have developed a Salesforce Lightning App that is powered by our Apis. We are the third party. The App typically sits in a custom tab within the Contact or the Company pages.
Our data is much richer when it includes user contextual data. The Salesforce user would typically also have an account with us, and so we need to authenticate the user before the Salesforce App is able to call our Apis on behalf of our user.
Our Api supports OAuth 2.0 protocol.
What are the options for authenticating the user in terms of where in the Salesforce workflow should it be done?
This is not a question about OAuth, we understand the protocol and have many other applications using it. This is a question specific to the embedded nature of the Salesforce Apps. They are essentially widgets situated within a host page and we are unsure of the convention or appropriate place to redirect off to our identity provider and accept the user credentials.
Would one option be to ask the user to associate their third party user account the first time they click on our custom tab? This would require a redirect off to our login page and then redirect back to Salesforce.
Is there an appropriate place in Salesforce to manage external third party accounts and trusts that Apps can integrate with?
Note - the happy path for either option should only require the user to authenticate once and the OAuth refresh token grant should take over from there.
Some advice would be greatly appreciated. Our main goal is to adopt the accepted conventions with Salesforce and not force the user to do anything out of the ordinary.