I have a custom AuthProviderPluginClass implementation that is working fine for authorization and the related registration handler in my community for External Identity users. I've configured the NamedCredential to use the authprovider, protocol OAuth 2.0, type=Per User. After successfully logging into the community context as a user following the authentication and authorization of the external provider any attempt to access the provider's API returns this message in the logs:

EXCEPTION_THROWN|[61]|System.UnexpectedException: You don't have permission to view this data. Ask your administrator to set up authentication for the external data source.

Any ideas on how to grant permission or otherwise bypass this for the very same external data source from which the user has already authenticated and authorized?

  • 3
    Does this answer your question? Use of Named Credentials seem to be tied to External Data Source
    – identigral
    Commented May 18, 2020 at 1:29
  • Thanks @identifral, I did see that question and that does solve the problem but not the way I’m hoping to find. Based on that solution my user authenticates and registers through the auth provider and then has to be instructed to go through and basically do the same thing again and for communities it’s especially awkward. Doesnt seem like I should have to move away from NamedCredentials to get the right user experience.
    – mtbclimber
    Commented May 18, 2020 at 3:09
  • Try adding the external data source to Profile and/or Permission Sets of your user(s)
    – identigral
    Commented May 18, 2020 at 4:50
  • Thanks again @identigral! I don't have an external data source (visible one anyway) but did try this approach with the Named Credential. It didn't seem to help. Is there another mechanism to get the row to show up in the User related list labeled "Authentication Settings for External Systems" beyond what's in help?
    – mtbclimber
    Commented May 18, 2020 at 20:00
  • You'd have to manipulate ExernalDataUserAuth object via Metadata API or (if you're really brave) via DML in Apex.
    – identigral
    Commented May 19, 2020 at 8:31

1 Answer 1


You can now create an ExternalDataUserAuth record from an autolaunch flow that you call via Apex. You will need to pass in an Auth. Provider ID and a Named Credential ID to the flow to populate the AuthProviderId field and the ExternalDataSourceId field respectively. Then you can use the current user's ID to populate UserId. This saves some clicks for the users.

However this won't be authorized automatically so you will still need to send the user through the authorization flow. If they have logged into the community via the same service then they shouldn't need to enter their credentials again.

You could send them through the flow via a popup window if you have an aura component or LWC that makes the API calls. The user would need to close the window after it succeeds.

The format of the URL for an OAuth flow would be:

externalAuthUrl = URL.getSalesforceBaseUrl().toExternalForm()+'/services/auth/xds/'+provider.DeveloperName+'?startURL=%2F'+ userAuthId.left(15) +'%3Fisdtp%3Dvw';

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .