0

I'm trying to connect to an external system using legacy Named Credential and a custom Auth. Provider (with AuthProviderPlugin class).

I'm able successfully call the endpoints when the access token is valid. However, when the token expires (the validity is around 18 minutes), I get 200 OK status but the response body is custom message 401 unauthorized from the external system.

I believe this causes the issue because Salesforce doesn't re-fetch new token since it is not 401 (https://help.salesforce.com/s/articleView?id=000381864&type=1). Hence, we continue to get this error unless I re-trigger Start Authentication Flow on Save on the Named Credential.

This is exactly same as this: https://trailhead.salesforce.com/trailblazer-community/feed/0D54V00007T46qjSAB

Is there a way to force refresh the access token in the named credential when this happens?

  • I cannot use the new Named Credential + External Credential because it is not supported by one of the licenses we use. (Salesforce had previously acknowledged this as a product limitation)
  • Also, I tried custom logic to fetch access token from Auth. Provider directly using Auth.AuthToken.getAccessToken() however, due to some kind of limitation, users get Access Token as null unless they hit the OAuth-Only Initialization URL (Custom REST controller to access Auth.AuthToken.getAccessToken returning null). This is not feasible since we cannot ask all of our SF users to hit this URL.
Improve this question
5
  • 1. Having a 200 status and a 400 body does not look like the way it should be implemented by the third-party system. If the external system is a partner company or something like that, you should ask for that to be changed. However I understand that you may not have the possibility to do so. 2. In order for this question to have some workarounds as answers, please provide details about the scenario: What are users doing exactly (clicking a button or something), how is this event managed (via flow, LWC, apex), and how is the named credential managed, and how is the auth endpoint called.
    – SGj
    Commented Jul 4 at 12:01
  • @SGj Thanks! Yes, it is not possible to bring changes in the external system. These are the Marketing Cloud cloudpages. The callouts are triggered from different sources. One is from the LWC quick action, few from invocable Apex via flow. The auth endpoint is called from the Auth provider plugin class to fetch the access token. The named credential mentioned in the question refers to this auth provider.
    – sfdcnewbie
    Commented Jul 4 at 13:51
  • @SGj Additionally, I think Marketing Cloud has a limitation of unable to send 4xx codes in cloud pages: salesforce.stackexchange.com/questions/340349/…
    – sfdcnewbie
    Commented Jul 4 at 14:27
  • External Credential (EC) supports this starting with Summer '24. What license doesn't work with EC? Without EC, custom auth provider (plugin) is the way to go. It's not going be nearly as clean or simple but with a fair amount of elbow grease it'll work, we've done it for customers prior to EC's existence. Look at suggestions in this thread.
    – identigral
    Commented Jul 4 at 16:55
  • Thanks @identigral for this! The license "force.com - App subscription" is the one not supporting EC. Also, the link you provided is useful, however, IIUC seems like it doesn't use the custom auth. provider, but custom logic within interface. We already have similar logic in place and we are looking for a more standard solution where access token and auth credentials are stored "securely" in Salesforce and not in Apex variables or somewhere easily accessible.
    – sfdcnewbie
    Commented Jul 4 at 22:11

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .