We have a heroku-hosted web app that used Salesforce as Identity Provider (IdP) to do Single Sign-On (SSO) between SFDC & other services. We know that in doing so our web app user are already logged into their SFDC account. Then what is the best way for our web app to obtain SFDC REST API access under user's SFDC account without asking for a password or redirecting?

We have basic understanding on OAuth, SAML and SSO. Also we have studied the following pages:

  1. https://help.salesforce.com/HTViewHelpDoc?id=remoteaccess_authenticate.htm&language=en_US
  2. https://developer.salesforce.com/page/Single_Sign-On_for_Desktop_and_Mobile_Applications_using_SAML_and_OAuth
  • Is the Heroku web app a Service Provider? Does it have access to the SAML Assertion from Salesforce?
    – metadaddy
    Sep 10 '14 at 20:52
  • Yes I think our Heroku app will be the SP and it has ability to access SAML Assertion.
    – Oscar Tang
    Sep 11 '14 at 3:09

You can pass a session ID as an attribute in the SAML Assertion. In the Connected App configuration for your SP, set $Api.Session_ID as a Custom Attribute value. The recipient will be able to use the session ID with the REST API.

  • Once again thank you for your reply. I have tried your solution. It works when I login as internal user with internal login portal. However it does not work when I login as an external user (community user) using community login portal. It gives the following error message when I use the session id to make REST API call: [ { "message" : "This session is not valid for use with the REST API", "errorCode" : "INVALID_SESSION_ID" } ] Any ideas?
    – Oscar Tang
    Sep 12 '14 at 9:49
  • Looks like communities users are locked down differently to standard. Investigating whether there's a way to do this...
    – metadaddy
    Sep 12 '14 at 23:15
  • @metadaddy Are you able to investigate the root cause, we are also facing the same issue
    – Lohith MV
    Jan 10 '18 at 9:30
  • @LohithMV No - I'm no longer at Salesforce. I suggest you contact Salesforce support.
    – metadaddy
    Jan 11 '18 at 6:02
  • @OscarTang were you able figure out the fix for this? even we have the same issue.
    – Sachin
    May 21 '20 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.