4

We are building a multiplatform architecture application in which we have an authentication consideration we're not finding a solution to.

We have a front end platform which has SSO with Force.com and interacts with our salesforce organisation where business processes are touched. The front end also does client side webservice calls to a big data database for searches on our catalogue (the database has some key features which salesforce can not compete with).

Now, the issue is that we want an airtight authentication and authorization in the application layer on top of the big data database. We'd like to keep a synchronized state of active user sessions between salesforce and a copy in the bd database. Is it possible to hook in (trigger of some sorts) to the salesforce user session lifecycle events, and say know when a user session start and ends so we could send an synchronizing update ?

  • What do you mean by "keep a synchronized state of active user sessions between salesforce and a copy in the bd database"? – Anup Aug 1 '12 at 8:39
  • Pretty much what "keeping a synchronized state of active user sessions between salesforce and a copy in another database" means. Have a user session table populated from salesforce with session events, so we do not need to verify the authentication session with salesforce for user X is still active on every incoming request. – Samuel De Rycke Aug 1 '12 at 8:45
  • So if the salesforce user is "logged in", then you don't want to authenticate the user accessing the big data database or the front end platform. Correct? – Anup Aug 1 '12 at 8:47
4

You cannot "hook in a trigger" to the Salesforce user session lifecycle events because you don't have access to them directly.

You probably don't need to, and correct me if I am wrong here, but aren't you allowing the user to be authenticated by the front end platform to the bd database(via webservice) and to salesforce(via SSO). You can use this authentication token returned by Salesforce to synchronize the active users sessions between salesforce and the database.

Anup

  • The front end is not connected to the database, but makes client side webservice calls. – Samuel De Rycke Aug 1 '12 at 9:01
  • Thanks! I've edited my answer. Does that make sense? – Anup Aug 1 '12 at 9:06
  • Well, client side also implies there can been modifications to the token right ?, we do not want to trust what comes from the client. We'd like an independent mechanism between the database and Sfdc to match against, ideally a synchronous state of authentication sessions. I guess that is not possible. – Samuel De Rycke Aug 1 '12 at 9:10
  • 2
    He's correct that you can't add any type of hooks or triggers to the session lifecycle in SFDC currently. There's also no clear indicator within SFDC anywhere when a session has ended or a user has logged out. Also, while a session is active SFDC issues a new session ID token when a session lives to half the session timeout value. So if your org is set to a four hour timeout, a new session ID is issued every two hours. – E.J. Wilburn Aug 1 '12 at 14:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.