1

My question is almost similar to one mentioned in 'Auth Provider with per-user Named Credential' (Auth Provider with per-user Named Credential).

I am trying to authenticate and make a API call when a new or existing Salesforce community users try to log in. The Authentication is provided by 3rd party (Cognito).

So, the requirement is :

  1. User to be authenticated using the 3rd party system for login.
  2. After successful authentication and before community page is displayed, the API call is to be made to 3rd party system to get more details about the user.

In order to achieve this:

  1. Created an Open ID Connect Auth. Provider
  2. Use the registration handler on the Auth. Provider to create/link a new/existing user.
  3. Use a login flow for API call.
  4. Use Per User Identity Type Named Credential to make API calls.

No, where I am having issue is once the user has authenticated successfully, how do I allow the user to make API call without authenticating it again. I am getting the error:

An Apex error occurred: System.UnexpectedException: You don't have permission to view this data, enter credentials for the named credential in your personal settings. Or ask your Salesforce admin for help.

I believe this error is due to the fact that the user is not listed under 'Authentication setting for External Systems'.

My requirement doesn't allow me to authenticate the user again, so how do I achieve this using either APEX or any other way?

Improve this question
2
  • Thanks for coming back on the query. The suggestion kind of highlight the same issue that I am currently facing. My user case requires the API call to be made on the login flow (that is even before the user has entered the community). For that, I need to add an entry into ExternalDataUserAuth object via Apex code? Is that even possible?
    – Rajiv
    Commented Sep 22, 2020 at 8:20
  • 1
    Not possible via Apex, unfortunately.
    – identigral
    Commented Sep 22, 2020 at 16:07

2 Answers 2

Reset to default
3

Since you have set the Named Credential to the per user, this means every user has to go through the authentication and OAuth 2.0 flow.

You may want to train your users to go through this from their personal settings as shown below to authorize and authenticate for one time.

enter image description here

Improve this answer
1
  • Thanks for coming back on the query. But my user case requires the API call to be made on the login flow (that is even before the user has entered the community). For that, I need to add an entry into ExternalDataUserAuth object via Apex code? Is that even possible?
    – Rajiv
    Commented Sep 22, 2020 at 8:20
1

The way I have finally got it working is: The authentication work is being handled by the auth. Provider which is an open ID connect type provider. Once the use has authenticated, salesforce gets the access token back. Then I have created a named credential which doesn't have any provider linked to it. It's a just basic annonymous type credential which holds the URL for the API endpoint. I did tick all the checxboxes though. Then in my apex call, I used the auth.authtoken.getaccesstoken to retrieve the access token lined to the logged in user. And this I can set it in the Authorization header. This seems to work. Please suggest if there are any other ways.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .