4

We created a Salesforce Connected App which should get its access token using SAML / OAuth2.

The request looks as follows:

https://test.salesforce.com/services/oauth2/token?grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Asaml2-bearer&assertion=[SAML_ASSERTION]&saml=[SAML_CODE]

It produces the error message:

400 (Bad Request) {"error_description":"user hasn't approved this consumer","error":"invalid_grant"}

With grant_type = authorization_code, the salesforce user is prompted with a screen asking him to give the connected app approval, but how is it with grant_type = urn:ietf:params:oauth:grant-type:saml2-bearer ? Will the user also be prompted? And when? and how will the prompt open? Or is with saml2-bearer or a pre-approval possible?

Thanks for giving me some insights!

4

After some extensive trial and error I finally found the solution for the error:

> {"error_description":"user hasn't approved this
> consumer","error":"invalid_grant"}

For whatever reason, the salesforce SAML/OAuth2 implementation needs to have the "Refresh Token" scope assigned in the Connected App settings. Without it - this error - appeared.

In the regular User/Password prompt OAuth2 Salesforce implementation this isn't required.

I managed to get it work on our Salesforce testportal using the built in Salesforce Identity Provider enabled.

  • You mentioned that setting refresh token scope assigned in the connected app settings. In the connected app settings for refresh token all I see is in this image: !OAuth Settings. How do I go about assigning a "refresh scope"? Thanks in advance for any help you can provide. I am pulling my hair trying to figure out why salesforce is telling me "user hasn't authorized this consumer" even after assigning the user's profile as well as permission set to the connected app. – user8242 May 6 '14 at 21:28
  • You can find these settings in Salesforce at: Setup->Build->Create->Apps->Connected Apps->{Your App Name}->API (Enable OAuth Settings) ... and then select both "chatter_api" and "refresh_token offline access". Hope it helps. – gaDev May 8 '14 at 10:09
3

According to the OAuth 2.0 SAML Bearer Assertion Flow docs,

The OAuth 2.0 SAML bearer assertion flow defines how a SAML assertion can be used to request an OAuth access token when a client wishes to utilize a previous authorization.

That might be an interactive user authorization via the web server flow (aka 'authorization code grant type'), or, more likely, admin authorization via the admin console.

Connected apps are added to the list at Manage Apps | Connected Apps either implicitly, the first time they are accessed by a user in that org, or explicitly, by an admin via the app's install URL. Either way, in the Connected App Edit page, the admin has control over which users can access that app.

Editing Connected App Policy

By default, users self-authorize access by clicking through the OAuth flow, but you can change 'Permitted Users' to 'Admin-approved users are pre-authorized' and specify profiles and/or permission sets pre-authorized to access the app.

So, create an appropriate profile or permission set, assign it to the user(s) in question, set 'Permitted Users' to 'Admin-approved users are pre-authorized', add the profile/permission set to the app, and your OAuth request should succeed.

  • Thanks for the answer. I had enabled "All users may self-authorize".The question is just when I get the {"error_description":"user hasn't approved this consumer","error":"invalid_grant"} message, then how should I react to it? To which URL do I have to redirect so that the user can grant this connected app permission? I have a Salesforce identity provider set up on the test portal, do I just redirect to it's login page? Thanks for the help! – gaDev Apr 7 '14 at 14:00
  • 1
    If you want to send the user through an interactive flow, you'll need to redirect to https://[your_mydomain_hostname]/services/oauth2/authorize?response_type=code&client_id=[your_client_id]&redirect_uri=[your_redirect_uri], and handle the response - see wiki.developerforce.com/page/… – metadaddy Apr 7 '14 at 15:15
  • Thanks @metadaddy, your explanation helped towards solving this issue. The main problem was a different one though => I've posted the solution to the main problem in the next answer. – gaDev Apr 8 '14 at 15:35
0

You may get this error if you haven't authorized the connected app for the user yet.

enter image description here

You can do this by logging in with the standard oAuth webflow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.