4

We have a heroku-hosted web app that used Salesforce as Identity Provider (IdP) to do Single Sign-On (SSO) between SFDC & other services. We know that in doing so our web app user are already logged into their SFDC account. Then what is the best way for our web app to obtain SFDC REST API access under user's SFDC account without asking for a password or redirecting?

We have basic understanding on OAuth, SAML and SSO. Also we have studied the following pages:

  1. https://help.salesforce.com/HTViewHelpDoc?id=remoteaccess_authenticate.htm&language=en_US
  2. https://developer.salesforce.com/page/Single_Sign-On_for_Desktop_and_Mobile_Applications_using_SAML_and_OAuth
  • Is the Heroku web app a Service Provider? Does it have access to the SAML Assertion from Salesforce? – metadaddy Sep 10 '14 at 20:52
  • Yes I think our Heroku app will be the SP and it has ability to access SAML Assertion. – Oscar Tang Sep 11 '14 at 3:09
2

You can pass a session ID as an attribute in the SAML Assertion. In the Connected App configuration for your SP, set $Api.Session_ID as a Custom Attribute value. The recipient will be able to use the session ID with the REST API.

  • Once again thank you for your reply. I have tried your solution. It works when I login as internal user with internal login portal. However it does not work when I login as an external user (community user) using community login portal. It gives the following error message when I use the session id to make REST API call: [ { "message" : "This session is not valid for use with the REST API", "errorCode" : "INVALID_SESSION_ID" } ] Any ideas? – Oscar Tang Sep 12 '14 at 9:49
  • Looks like communities users are locked down differently to standard. Investigating whether there's a way to do this... – metadaddy Sep 12 '14 at 23:15
  • @metadaddy Are you able to investigate the root cause, we are also facing the same issue – Lohith MV Jan 10 '18 at 9:30
  • @LohithMV No - I'm no longer at Salesforce. I suggest you contact Salesforce support. – metadaddy Jan 11 '18 at 6:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.