6

I am building a beta managed package in which I created a connected app ( which generated its own clientsecret and clientid in my dev org).

Now when someone install this package in their org they all will get a copy of my class ( having rest api) lets suppose CreateANewContact.

If any of the rest client say postman want to acces my REST API first need to get the access token and then the refresh token. To get access token following params are important ClientID,ClientSecret,UserName,Psssword.

I have only one clientid and clinetsectrect which belongs to my dev org.

Q1 Question is how the REST Client who are trying to access REST API belong to below org will be accessed.?

Org A ClientID ? Client Secret ? Org B ClientID ? Client Secret ?

Q2 : Will org A and B have their own seprate clientid and client secret or to access their api the same clientid/clientsecret which was generated in dev org can be used ( could be an exception in case of managed package) ?If yes then how can i use them.

Please correct me if I am wrong anywhere in above explaination.

Thanks in advance

Improve this question

2 Answers 2

Reset to default
4

The Connected App provides a way for you, the ISV, to obtain access to a customer's org via oAuth. If you follow the flow here, the customer would click on a link/button provided by your package that would ask them to authorize your app and direct them to an endpoint where the oAuth process provides you, the ISV, with an authorization code. You then use that code along with the Client Id and Client Secret from your ConnectedApp to request an oAuth access token from Salesforce which you can then use to access to the Customer's org via REST based on the access the Connected App provides.

The key part from an ISV perspective is having an endpoint where you can retrieve the initial code and swap it for an Access Token - when I have done this, I use my Salesforce LMA org as a secure endpoint, and then execute some code there to get the access token.

Note - you don't even need to include the ConnectedApp in your package - so long as you provide the means via a link or button for a customer to initiate the oAuth flow, that is sufficient.

Improve this answer
0

enter image description here I got your point so for example if I have a LMA org (Assume it as Outh2.0 server) and 2 client Orgs.. I can create a button in client's org to get my client's user authenticated from LMA per steps given in webserverflow.

Now here are the actual steps. Mine is a free app and have APEX REST API build into it. Orgs installing my app will have a copy of REST API Created by me. There will be a third party web application which wants to interact with all my client orgs.. and want to consume specific APEX REST API. Where I am not clear is my packaging org has a clientid/clientsecret but my client orgs dont have ( fine as you said above there is no need to package connected app). Then can you give me steps how a thiordparty can interact with my REST api ( which is in multiple orgs)

Please have a look at the screenshot created by me.

So sorry if I am missing any basic point and asking this again.

Thanks for your previous reply and help.

Improve this answer
1
  • If you want your third party app to be able to interact with the REST API in the Client Orgs, you need to store the refresh token somewhere so you can get a new access token when required. So it depends on who initiates the request - Client Org or Your Web App. If client org, you could store it in a protected custom setting in each org, and send it to the Web App when the client org makes a callout so the web app can get a new access token. If you web app initiates it, it will need to securely store the refresh token, and get a new access token when it needs to access a particular client org.
    – BritishBoyinDC
    Apr 22, 2014 at 17:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .