Authenticated Lightning Out with another Salesforce Org

Question

Immediate Question: Is there a way to use authenticated Lightning Out with another Salesforce Org?

We've currently got two Salesforce Orgs: Org A and Org B In Org A, we've created a flow that allows users to create cases against account records, and flow consists of dynamic flow screens. Now, we want that same flow to be used in Org B, that would allow the users from Org B to create cases and associate them with accounts in Org A.

Upfront, we could replicate the flows in Org B(packaged), and setup apex rest api callouts that would allow it to create cases in Org A. But the problem with that is we're going to be maintaining logic from two different orgs. Another alternative would be creating a community from Org A, expose the flow in the community, create community users for Org B, problem with this is that neither Org A and Org B want to cover the cost for the community licenses.

After looking for alternatives, I stumbled upon Lightning Out, which allows you to expose a component onto another web container. So I was thinking of using Org B as the web container for the app that we're building from Org A.

This looks easy if we're just going to be sharing the app as unauthenticated. But we want it to be authenticated for security reasons, because CORS whitelisting is not enough as a security control to prevent the app from being used from other domains.

So going down the path of Lightning Out Authentication, there's two ways of authenticating in Lightning Out

There are two supported ways to obtain an authentication token for use with Lightning Out.

• On a Visualforce page, using Lightning Components for Visualforce, you can obtain the current Visualforce session ID using the expression {! $Api.Session_ID }. Sessions initiated using the session ID are intended for use only on Visualforce pages.
• Elsewhere, an authenticated session is obtained using OAuth, following the same process you’d use to obtain an authenticated session to use with the REST API. In this case, you obtain an OAuth token, and can use it anywhere.

Obviously the first one isn't applicable, given that it would only work if you're showing the component in the same org using a visualforce page.

Looking at the second one, it looks straight forward at first(ref. Salesforce to Salesforce Integration):

1. Create a Connected app from Org A
2. Create an Authentication Provider from Org B (Salesforce using the Connected App from Org A)
3. Create a Named Credentials from Org B that uses Org A as an endpoint, and uses Named Principal(Integration User), OAuth, and Auth Provider from step 2.

But this is where I got stuck, I can use the named credentials in Apex to execute callouts to Org A. But I couldn't pass the Oauth Token from my Named Credentials back to client side on my VFpage in org B to render my Lightning Out app

$Lightning.use() takes an oauth token or session id on the fourth argument

VFPage

<apex:page showHeader="false">        
  <apex:includeLightning />
        
        <div id="lightning" />
        
        <script>
        $Lightning.use("c:testApp",    // name of the Lightning app
                       function() {                  // Callback oncruue framework and app loaded
                           $Lightning.createComponent(
                               "c:auraFlow", // top-level component of your app
                               { },                  // attributes to set on the component when created
                               "lightning",   // the DOM location to insert the component
                               function(cmp) {
                                   console.log('component created');
                                   // callback when component is created and active on the page
                               }
                           );
                       },
                       'https://dx-lightningout.cs115.force.com/out',// Community endpoint
                        'oAuthToken/sessionId'
                      );
        </script>
  </apex:page>

Questions

• Is there a way to pass the oauthtoken/sessionId from Named Credentials to Client side(vfp) for Lightning Out?
• Can Lightning Out be used with another Salesforce org?
• Should I be even doing this, or just go down the path of using a packaged app installed in Org B with the App, Auth Provider, and Named Credentials?

Answer 1

You can't get the access token from Named Credential, it acts as a runtime proxy. Once initialized, Auth Provider can give you the token via AuthToken.getAccessToken(authProviderId, authProviderName)(docs). To obtain the auth provider ID and name you can look at its entry/details screen via the admin console. You can call this method in your server-side controller backing the VF page and get the token. From there, you can send it to your VF page in the usual manner.

Answer 2

Here are a couple of options:

1. use a connected app to authenticate + APEX in org A to authenticate and use the flow in org B. The downside for this option is (1) flow UI screens cannot be re-used and (2) this option is best for auto-launched flows only

2. use Canvas

• https://developer.salesforce.com/docs/atlas.en-us.platform_connect.meta/platform_connect/canvas_framework_intro.htm
• https://help.salesforce.com/articleView?id=flow_distribute_internal_vf.htm&type=5
• https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/components_using_flow_cmp.htm