Generate jwt access token for integration user

Question

I am trying to use the new integration user license with the Salesforce API Only System Integrations profile. I created a user with a password and given them a permission set with a type of Salesforce Integration, but I am unable to generate a token for the user for a connected app.

I have an oauth connected app for postman and I am able to generate a token for my normal admin user but it does not work for the integration user.

I am sending in the grant type, username, password, clientid, and clientsecret. The password has the security token attached to it and it works fine with other accounts. When I try to generate a new token, I get this error Error: invalid_grant, Description: authentication failure with no other details.

Is there a different flow for getting the access token for integration users vs traditional users? What could I be doing wrong here?

Answer 1

Valeriy
I just tested successfully connecting to a scratch org with Postman using user wih the Salesforce Integration license. Both with password flow and jwt flow. Seemingly there is not a difference in the authentication procedures.

How do you exactly construct the request? I am a bit confused by your statement that you send "grant type, username, password, clientid and clientsecret" but you are asking about JWT flow.

If you send all that it the grant_type should be 'password': This is what works for me:

POST {{AuthTokenUrl}}/services/oauth2/token?grant_type=password&client_id={{client_id}}&client_secret={{client_secret}}&username={{username}}&password={{password}}{{pwdsecuritytoken}}

JWT flow is a bit more complex (https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_jwt_flow.htm&type=5), the token has to be calculated first in the PreReqeust script. ...

Answer 2

I have found the solution.

It turns out you do not need the users security token to generate the access token like you would for other users. You simply use the password by itself and that generates a valid access token.

It makes sense since you cannot login as the integration user and it is not possible to get/reset a users security token without logging in to the salesforce user interface.

Essentially like this: POST {{AuthTokenUrl}}/services/oauth2/token?grant_type=password&client_id={{client_id}}&client_secret={{client_secret}}&username={{username}}&password={{password}}

I forgot where I learned you can do it this way but I will try to post it once I find it again.

You can also do this: https://salesforce.stackexchange.com/a/56664/85722

Using that solution it seems like you can change an existing salesforce license into a integration user without having to reset the security token. If you have the security token, you can proceed to use the integration account like it was a normal user license after you change its permissions.

Answer 3

For grant_type=password flow, when you do require a Security Token to be passed along with the actual password in the "password" section. For the user with "Salesforce API Only System Integrations" profile. Just make sure for the integration user you use the email you actually have an access. Then login to the system as your self (I assume you are an Admin), then navigate to the integration user details and do "Login As".

Integration User License does not allow to login with this user credentials in the browser, but you still can do Login as.

Then just follow regular path, go to the User Settings -> Reset Security Token.