0

I have setup a connected app with the "openid" scope. Using the web server flow, my callback is able to get the Open-ID JWT from "id_token", generated by Salesforce. My API has no problem validating this token.

The question is this: Given this JWT, how can I use it to authorize REST calls to SF?

From my research, I cannot. It appears I have to use it to obtain an Access Token. I have yet to see a concrete example of this... Salesforce consuming its own Open-ID JWT in any way. Any help would be appreciated, thank you.

1

Access token and ID token are two different animals. The former is used for authorizing API calls, the latter is used for authentication of end-user by your application/client. You cannot use an ID token to authorize calls, there's no such provision in oAuth and/or OpenID Connect spec. From the docs, the steps involved in Web Server flow (aka authorization code flow in OpenID Connect):

  1. Request an Authorization Code
  2. User Authenticates and Authorizes Access
  3. Salesforce Grants Authorization Code
  4. Request an Access Token
  5. Salesforce Grants an Access Token

The OpenID Connect flavor of this is based on response_type being set to code in step 1 and having openid as one of the requested token scopes on the connected app. Assuming you've done this correctly, when you exchange authorization code for the access token in step 4, the response that comes back to your client in step 5 should look like this:

{
"access_token": "00DB0000000TfcR!...",
"signature": "...",
"scope": "web openid",
"id_token": "..."
 ...
}

There are other keys that come back in this JSON structure, it's been redacted for the purposes of this answer. Value of id_token is the ID Token data structure in JWT format, this is the primary extension that OpenID Connect makes to OAuth 2.0 to enable authentication of end users. Value of access_token is the OAuth access token that can be used for authorizing API calls. You grab the value of access_token and make a call to any SF REST API by adding the Authorization header to your HTTP request in the format Authorization: Bearer <value of access_token>. Example with production SF API that lists resources by platform version:

GET /services/data/v47.0 HTTP/1.1
Authorization: Bearer 00DB0000000TfcR!...
X-PrettyPrint: 1

Response (redacted for brevity):

{
  "tooling" : "/services/data/v47.0/tooling",
  "metadata" : "/services/data/v47.0/metadata",
  "eclair" : "/services/data/v47.0/eclair",
  "folders" : "/services/data/v47.0/folders"
  ...
}
2
  • Thank you @identigral, but I am aware of how to use an access token and how to get the open id token. What I am asking is: How can I use the Open ID Token to accomplish anything in Salesforce? Is there any way to use the JWT to get an Access Token? I am wanting to take action on behalf of a Salesforce user, basically issue a Platform Event back to Salesforce, and all I have is the JWT. – Brandon Petty Jan 28 '20 at 19:15
  • Authorization / delegation of access (aka take action on behalf of a Salesforce user) is done with access tokens; you do have the access token at the end of authorization grant flow. Purpose of ID token from OIDC spec: OpenID Connect returns the result of the Authentication performed by the Server to the Client in a secure manner so that the Client can rely on it . It's for your application to do stuff with. – identigral Jan 28 '20 at 21:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.