2

I am going to authenticate as a portal user in a community via REST API using Web Server flow. I want to try this out in Postman, but I am receiving 401 Unauthorized error every time. I have set up a Connected App that allows scopes full and refresh_token. Now, I am following guidelines from the docs site and sending a GET request to endpoint

{{url}}{{site}}/services/oauth2/authorize?response_type=code&client_id={{clientId}}&redirect_uri={{redirectUrl}}&scope=full refresh_token

where the URL is https://myawesome-developer-edition.eu17.force.com/siteName and clientId and redirectUrl are matching to my configuration in the connected app.

Unfortunately, I am receiving unauthorized response with HTML page like this

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
    <meta HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">
    <script>
        function redirectOnLoad() {
var escapedHash = '';
var url = 'https://myawesome-developer-edition.eu17.force.com/s/login?ec=302&inst=1v&startURL=%2Fsetup%2Fsecur%2FRemoteAccessAuthorizationPage.apexp%3Fsource%3DCAAAAXdj-6WvME8wMXYwMDAwMDA4T0k3AAAA5Ej60fQoPEOPWhHcqCA17JB7HzSFX7DwuxJ489jZzOL34V_JJznsBdJhZCE5XWsO3Rbdw6gzxmZwuwTb5wHsjdetSCVP8rtbL1eJPM5XEXiMPLTvVSD1pJIIX0g_pqUeiP0tXh2mcfYkfifywGova6w75kiaIHL0VD5FddHBvnUjdI1DtRwOXCZon7yy_9uOU5Bvht8p_hEXKsUyHy5XDu2M5IpMEkTdiO6nJG3h49JG7MRyv3Z_MiNFXbJUTOmuzhZSSUHd1PCSmeGDd5bJ__CLN7DiBNxB6eLVmekdq9L4-7uhtI2j9tJKocTAzE-HgUgS3UM6CFl7JXqervLuYIlB0r3z7z4S-BoIFrDf6iZWlHIFpBTogtaz9whRdCx1dxOWJDNz0x8mSs30gOAH-c1mjY_xyiMapOxgTAHAHJ2ECm7D8Vbaefu2b4ygNCW75-zYqZ8SfNr4-qHPy5ze05zhvfZu5wNgBIYSDi7F9E5bDD_2Bg19vGrYOBih5VQB0Yx9hPMpce5hbuDJadjKmYiuxJvvIqf2hv8bfVW_V_6EhTjJ62R7IR5dFzyDdzAQo25uTCeZW0JoYFb4hGg-CyN8BUibB46xvi9za9PmVPlZqB53OTvr5PkJvMo5JBF7RXG9sLTVpIWOL1Z9QRnJAeoUMmSrAgCK1eLIuF5iv3JqWlqQe4gwMM8d0fcmZ9OlQw%253D%253D';
if (window.location.hash) {
   escapedHash = '%23' + window.location.hash.slice(1);
}
if (window.location.replace){ 
window.location.replace(url + escapedHash);
} else {
window.location.href = url + escapedHash;
} 
} 
redirectOnLoad();
    </script>

</head>
</html>

Does anyone have an idea how to get this to work? I have tried also with the agent flow with the same result.

Improve this question

1 Answer 1

Reset to default
1
+50

Web Server OAuth flow is supposed to be used on browser. So you shouldn't really be testing this in Postman. Copy the URL and paste it into browser URL bar to test.

Here's how Web Server flow is supposed to be implemented.

  1. You have a webpage with Login/Authorize button. User clicks on it. User is redirected to following URL {{url}}{{site}}/services/oauth2/authorize?response_type=code&client_id=... You can window.location.replace to perform redirection. No need for server trip.
  2. User is on the Standard Salesforce Login page. User enters username and password, logs in, then Authorisation page appears (page with "Allow Access?" title). On this page, user can see Connected App details and permissions and if he's fine with it will click on "Allow" button.
  3. User is redirected to redirect_uri URL along with code or access_token (based on response_type param) in URL. Using window.location.href, get the URL, perform string manipulation to retrieve token and related info sent by Salesforce OAuth.

Now, if you received code in the URL, then you need perform additional HTTP call to retrieve access_token. If you received access_token, then you can directly start using it.

I recommend spending some time reading this article. It's very well explained how to use Web Server flow.

Hope this helps.

Improve this answer
5
  • Thank you for this amazing answer! I was thinking this flow is dedicated to browser flows and I'm glad you confirmed my thoughts. I noticed the same is happening for the Agent Flow, so is there any flow that will allow me to log in as a Community user that i could test in postman, without a need to leverage salesforce login page?
    – jm.
    Feb 8, 2021 at 18:41
  • BTW. Interestingly Salesforce shared both flows in their api collection in Postman here: developer.salesforce.com/blogs/2020/03/… . Weird move if it is not supposed to be tested in there.
    – jm.
    Feb 8, 2021 at 18:43
  • Postman can handle oAuth authorization code grant type (aka Web Server flow in SF universe): learning.postman.com/docs/sending-requests/authorization/…
    – identigral
    Feb 9, 2021 at 3:51
  • @identigral I know it can, but I am wondering here what type should be used to integrate two systems where one of them should log in to salesforce as a community user. As Jay mentioned, it is supposed to be used by the user not by two systems.
    – jm.
    Feb 9, 2021 at 9:18
  • You can model this flow in Postman as an end-user.
    – identigral
    Feb 9, 2021 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .