0

So I implemented a custom Auth for Client Credentials flow using example from "https://lekkimworld.com/2021/05/07/custom-salesforce-auth-provider-for-microsoft-azure-client_credentials-flow" . I have oAuth working. My app requires that I pass Client_Id in the header. I'm trying to fetch client id using named credentials "{!$Credential.OAuthConsumerKey}". I have "Generate Authorization Header" unchecked and "Allow Merge Fields in HTTP Header" checked in the named credentials. I have the following code to invoke the API.

 String Body = '{"message":"some text"}';
    HttpRequest req = new HttpRequest();
    req.setEndpoint('callout:mynamecred/abc');
    req.setHeader('Content-Type', 'application/json');
    req.setHeader('Accept', 'application/json');
    req.setHeader('dummy','{!$Credential.OAuthConsumerKey}');
    req.setMethod('POST');
    req.setBody(Body);

Here's the header that I can see at the server

{
  "VERSION": "HTTP/1.1",
  "CONNECTION": "close",
  "ACCEPT-ENCODING": "gzip",
  "USER-AGENT": "SFDC-Callout/54.0",
  "SFDC-STACK-DEPTH": "1",
  "ACCEPT": "application/json",
  "CONTENT-TYPE": "application/json",
  "CACHE-CONTROL": "no-cache",
  "PRAGMA": "no-cache",
  "CDN-LOOP": "cloudflare",
  "CONTENT-LENGTH": "23"
}

If I pass a hardcoded value in the header "dummy" , I can see it. I have a feeling , the custom Auth doesn't work with Merge fields. Any thoughts?

4
  • Your feeling is correct, at least for {!$Credential.OAuthConsumerKey}. It might be able to merge the access token (not your use case).
    – identigral
    Commented Feb 15, 2022 at 16:39
  • 1
    ugh, that is really unfortunate. it just defeats the purpose of using named credentials for credential storage. Any suggestions on how to pass the client id in the header without hard-coding it? I tried access token too, it's empty as well.
    – premkris
    Commented Feb 15, 2022 at 16:43
  • You can use the loop hack - see answer by Mathieu in this Q&A. While this could work, we don't recommend going this route or trying similarly 'sophisticated' solutions. Consumer key in oAuth is public by definition, there's no security value in overengineering this. Store in custom setting or custom metadata and go from there.
    – identigral
    Commented Feb 15, 2022 at 16:48
  • That's fair on the consumer key. I was mostly curious. I'm doing the loop hack already.
    – premkris
    Commented Feb 15, 2022 at 17:18

0

You must log in to answer this question.

Browse other questions tagged .