5

I'm new to the OAuth concept in Salesforce and looking for some pointers for my use-case. I'm not even sure if I'm framing my question correctly, but I'm trying to understand if I can invoke an Apex Rest API using Azure Ad as the identity provider(assuming that Single Sign-On is enabled in the Salesforce org with Azure as the provider).

Use Case:

We have a web app that uses Azure Ad for authorizing the users(SSO to the app using windows credentials). On successful sign-in, the identity token is stored on the client-side(I believe mostly in a cookie).

The client should provide a component to post messages to Salesforce Chatter Rest API. Due to the request being a CORS request, Salesforce OAuth endpoints cannot be accessed, hence Username-Password OAuth Authentication Flow cannot be used. Also, there is a business requirement that the user should not be redirected to the Salesforce login screen for creating an active session, so User-Agent OAuth flow is also not an option.

So, I'm trying to explore the case where Salesforce acts as the Authentication Provider for the Azure Ad IDP. Now, here are my questions:

  • Is it possible to invoke Salesforce Rest API with this Azure token?
  • If yes, what are the steps that I need to follow?
  • Also, please provide some pointers for configuring Salesforce and Azure integration with Azure as IDP and Salesforce as ADP
Improve this question
4
+25

In general, for oauth to work, the user needs to authorise salesforce to perform requests on their behalf.

If you haven't done it already, I suggest you go through the documentation on the many different types of oauth flows, and see if one of them fits your scenario.

https://help.salesforce.com/articleView?id=remoteaccess_authenticate_overview.htm

Generally speaking, you have to have a salesforce session id/access token in order to make requests with any API, be it the Salesforce SOAP API or the REST API. How the client gets a hold of that session id is irrelevant ones the client has one.

So what you need to figure out is how to get a session id/access token, which is why you should study in detail every oauth flow.

Also, if Azure can send a SAML Assertion to salesforce in order to log in, you can use the same SAML Assertion to get a session id/access token.

https://help.salesforce.com/articleView?id=remoteaccess_oauth_web_sso_flow.htm&type=5

Here are some docs on how to send SAML Assertions from Azure to Salesforce

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/salesforce-tutorial

Best of luck!

Improve this answer
3
  • 2
    I think this answer is great! I just want to point out that the SAML Assertion flow uses the Salesforce Single Sign on settings instead of a Salesforce Connected App settings (most common resource for Oauth flows). The beauty of the SAML Assertion flow is that you wouldn't have to pre-approve NOR would the user have to self-approve like with Connected Apps. The SAML Assertion flow would be my first pick for this use case as well.
    – Glen De Marcos
    Nov 7 '19 at 2:11
  • 1
    Thank you for your inputs. SAML Assertion Flow and JWT Bearer Token flow are two OAuth flows that can be used for getting OAuth access token from Salesforce without the need for login credentials. These flows are used for Server to Server integration but they can't be used from a Browser as the token request goes to the OAuth endpoint in Salesforce and CORS is not supported for it as per the documentation. So, in either case, a proxy is needed to make the request. What I'm looking for is to avoid this proxy and see if Salesforce can provide the access token if Azure is added an Auth Provider.
    – Prudhvi Konda
    Nov 7 '19 at 6:25
  • 1
    Anyways, I did my research and the approach we are taking is to build a proxy auth service that implements the JWT Bearer Token flow. The Azure Ad User details are sent to this proxy service and JWT claims are created using these details and the token request call is invoked. Once the access token is received, this token is then sent as the response by the proxy service to the front-end. Thank you again for your inputs.
    – Prudhvi Konda
    Nov 7 '19 at 6:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.