I'm developing a hybrid mobile app that wraps Salesforce1 UI (/one/one.app) of communities. My community uses SSO and Auth Providers to login a user against their home org Salesforce credentials.


The problem that I'm trying to answer is where to derive the refresh token for the app. If I use the application provider (my community org) to derive the refresh token, then I have no way of know in my community when/if that user has been deactivated from his/her home org. A user could potentially login to the app long past the time that person should have access to the community. If I use the user's home org as the source of their refresh token, I have to support an auth flow that I'm not sure the hybrid SDK was designed to support, and I've noticed issues on session timeouts.

Some options I've explored but haven't implemented yet are using the Identity API to poll a user's home org periodically to find out if the user is still active and then deactivate the user accordingly in the community.

Other ideas or opinions?

  • Is the user logging in as Portal User or as a SF User when they visit this community via your mobile app? The former is directly Contacts based while the latter is much less Contacts based, so I'm confused by your question. The answer would seem to depend on your security model for access to the community.
    – crmprogdev
    Jul 20, 2014 at 17:02
  • I'm asking about communities/external users
    – greenstork
    Jul 21, 2014 at 4:23

1 Answer 1


I think periodically checking the state of user in the user's home org is the better way to solve this. You can use the AuthToken class to obtain the user's session info for that home org. And then use the identity url to validate the user.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .