We are developing an AppExchange application which integrates with external application .Every customer has a connected app because of different branding and different and different callback URLs. Currently to make a connection from external system to Salesforce Customer Admin needs to copy client Id and client Secret in external application and save in the external application. To make user interface simple we want to following:-
- Customer Admin User to configure connected app.
- In the Appexchange application config wizard enter the client id , client secret and redirection URL and click on Login to External system button.
- On click of the button Client Id, Client Secret and Redirection URL will be passed to external website in an Encrypted format.
- User will login to external system and then for that external application the Client ID, Client Secret and Callback URL will be stored in External System.
- Then external application will redirect user to the Salesforce URL to Authenticate the access using connected app.
- After successful authentication and once system admin allows the access, the refresh token/access token returned from Salesforce will be stored in External System.
Question: To makes configuration steps easy, we will need to pass the Client ID, Client Secret and Callback URL in Encrypted format to external system. The Encryption key will be stored in a Protected Custom Metadata, which can be same for all customers to reduce the configuration steps. From security review perspective, is it a secure approach to pass encrypted ClientID, Client Secret and call back URL in the URL?