I am trying to authenticate to Salesforce from 3rd party service (custom java app). Users in the 3rd party app should be able to search records in salesforce (query rest api call) and create new records. However they should not authenticate to Salesforce every time they open the app (web server oAuth flow wouldn't be very user friendly). Ideally user in the 3rd party app shouldn't even know records are coming from Salesforce.
- All users of 3rd party app can also access salesforce and vice versa
- Both apps authenticate users with 3rd party iDP
Theoretically the best candidate here would be JWT bearer flow https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_jwt_flow.htm&type=5 However that flow, if I understand it correctly, will give access to salesforce records with permissions of user defined in the managed app.
How can I possibly run salesforce's rest api query as a given user as opposed to that integration user from the connected app? I want to respect sharing hierarchy in salesforce while making these queries