3

My Managed Package app connects to an external REST API. This API uses OAuth2. For easy connectivity, I planned on packaging a custom AuthProvider with all the app-specific settings like URLs and Client Id and Secret and then have a NamedCredential that is using it.

The problem I face is that I cannot package an AuthProvider, only a NamedCredential.

As a workaround, I create the AuthProvider and NamedCredential from an Admin-controlled Setup page using Metadata API. But by doing that the customer Admin sees the Client Id and Secret and could potentially misuse it to talk to the API using my Client Id.

Why doesn't Salesforce allow us to package AuthProviders? At least the org-unspecific parts.

Note: I understand that read-only properties like URLs are org-specific but Salesforce could easily build AuthProviders to make that dynamic and only contain org independent info.

  • 2
    If you create an idea, we'd vote for it. – identigral Sep 23 at 18:24
6

Auth Provider is org specific. It has a callback URL where a connected app redirects after authentication and org get authcode and complete the rest authentication steps.

If salesforce allows Auth Provider to be packaged then redirect url will be same (same as packaging org) for all the subscriber orgs and it will redirect incorrectly to packaging org instead of subscriber org. This is the reason why salesforce can not allow packaging Auth. Provider.

| improve this answer | |
  • How can we configure different callback URLs for the connected app in each subscriber org? – rahul gawale Sep 23 at 10:42
  • You don't have to configure it manually. Salesforce automatically create callback url with following pattern https://<Instance Url>/services/authcallback/<Auth provider name> – Sushant Srivastava Sep 23 at 11:07
  • 2
    That’s not a real answer. Salesforce could just build auth providers in a way that it only contains org independent information – Robert Sösemann Sep 23 at 11:55
  • 1
    @rahulgawale, you are asking it at the wrong place. Here is easiest the implementation of your scenario. 1. Create a Connected App in Salesforce packaging org (or any other org, except scratch org because scratch org get deleted automatically) 2. Register Wordpress call back url in the connected App. 3. Use this connected app's client Id and client sceret to connect wordpress to salesforce. 4. You can use this client Id and sceret to connect any salesforce org from wordpress (not only packaging org). 5. You do not necessarily need to package this connected app (If you want you can do). – Sushant Srivastava Sep 23 at 12:49
  • 1
    +1 Thanks, @SushantSrivastava. – rahul gawale Sep 23 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.