I have set up a Canvas App that is using the Signed Request Access Method. I have defined a Custom Attribute for the app to pull from a Custom User Field. But when I look at the Signed Request from my target application, I don't see the custom attribute/value anywhere. How do I access that custom attribute from the Signed Request?

The workaround I have for now is to call back using the canvas API to get the User Object and read the value I need, but didn't think I should need to do that with the Custom Attribute.

Am I misunderstanding what the Custom Attributes are? Am I missing something in my setup or just looking in the wrong place for those attributes?


Another option may be to pass parameters in the VS Page opening the canvas app. But I haven't found how to pull from an existing SF Object field. Again, in this case it's a Custom Field on the User object Something like:

<apex:page >
  <apex:canvasApp applicationName="AppName" parameters="{parmName: User.customField}"/>

Edit 2 Code/Setup:

VS Page:

<apex:page >
  <apex:canvasApp applicationName="AppName"/>

Canvas App receiving Signed Request:

    public void authenticate(HttpServletRequest request, HttpServletResponse response) throws GatewayException
        logger.debug("Authenticating Salesforce login attempt.");

        String signedRequest = request.getParameter("signed_request");

            logger.debug("Authenticating signed request: " + signedRequest);

        if (signedRequest == null)
            throw new GatewayException(SalesforceConstants.UNSIGNED_REQUEST, "The request must be signed.");

            //Custom attribute not in the JSON string
            String signedRequestJSON = SignedRequest.verifyAndDecodeAsJson(signedRequest, consumerSecret);
            CanvasRequest canvasRequest = SignedRequest.verifyAndDecode(signedRequest, consumerSecret);
            //canvasParms is empty
            Map<String, Object> canvasParms = canvasRequest.getContext().getEnvironmentContext().getParameters();

                logger.debug("Authentication verifed.");
            requestData.put(SalesforceConstants.SIGNED_REQUEST_JSON, signedRequestJSON);

            //TODO pull from signed request
            requestData.put(SalesforceConstants.LOGIN_ID, "JWALKER");
            requestData.put(SalesforceConstants.ACCOUNT, "CURRENCY");
        catch(SecurityException se)
            throw new GatewayException(SalesforceConstants.UNVERIFIED_REQUEST, "Signed request was not verified.", se);

Canvas App Configuration with Custom Attribute (I'm trying to read "cp_config_id" in my Canvas App): enter image description here


1 Answer 1


When you retrieve your body in the canvas app it will have 2 elements, 0 will be the secret, and one will be the encoded envelope. The parameters will be in this object. If you post your code I would be happy to take a look.

EDIT: A sample of a VF page and Controller

<apex:page ="canvasCON" >
<apex:canvasApp applicationName="Appname" canvasId="appname" parameters="{!jParameters}"  />  

public with sharing class canvasCON{
private user u;
public canvasCON(){
    this.u=[select id,acme_configuration__c from user where id=:userinfo.getuserid() LIMIT 1];
public string getjParameters(){
    string json;
    String jsonout = '{'+
    '  \"cp_config_id\": \"'+User.acme_configuration__c+'\",'+              
    return json;
  • Thanks for responding. I've posted (hopefully) all of the relevant information in my "Edit 2" to the main post. Sep 24, 2014 at 14:07
  • So, the Custom Attributes are used as part of the SAML or OAuth flows: docs.releasenotes.salesforce.com/en-us/winter14/release-notes/… What you may want to do is have a simple VF page and controller to retrieve the attribute and pass (in JSON format) to the canvas app.
    – JimRae
    Sep 24, 2014 at 20:01
  • for your "<apex:page>", what attribute are you using for the "canvasCON"? Is that standardController or controller? If we're already using a standardController for creating a VF page (such as "Lead" or "Contact") in order to attach that page to a custom button, how would we accomplish this? Would we need to extend the Base Contact/Lead Objects and use those custom objects as the controller? Sep 24, 2014 at 20:29
  • Was supposed to be controller (a custom controller). You could also use a standard controller with an extension.
    – JimRae
    Sep 25, 2014 at 1:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .