"App must be invoked via a signed request" shows in Canvas Previewer

Question

I have connected App and added external link of Heroku to show as Canvas App. I have set the location Chatter Tab. In the developer account, my external application is accessible. It has set "Admin approved users are pre-authorized" in Oauth Policies. The external application is visible in Canvas Previewer.

After installing Application in another Salesforce developer account, It shows "App must be invoked via a signed request" in Canvas Previewer., and has "All users may self-authorize" in Oauth Policies. I have gone through this link

Canvas Signed Request not sending refresh_token, and I got an idea that applications should approve by Admin. I am still not sure that is the issue or something else.

Any help would be great !

Thank you ! :)

Answer 1

The Secret Code which is auto generated in your Connected APP needs to be configured in the HEROKU application. please note eveytime when you move your connected App from one Org to another. salesforce will create new Secret Key (Consumer Key). this key should be enabled on Heroku side so that when you try to call your Heroku app from new Org it knows that - you are authorized because your canvas app will send a singed request to Heroku containing your secret key and other parameters in JSON format.

heroku application will read this secret key (which is kind of challenge-response), then you will get destination application loaded into your canvas.

Thanks TJ

Answer 2

The issue is that when your Connected App is set to "All users may self-authorize", if they have not yet approved the app then the POST request with the signed request is not sent to the server. Instead a GET request is sent with the _sfdc_canvas_authvalue parameter. Your Canvas app then needs to handle this by initiating the approve or deny OAuth flow, then calling repost() when this is complete the retrieve the signed request.

When your Connect App is set to "Admin approved users are pre-authorized" the POST request with the signed request is always sent if the user has been configured to use the app by their administrator. Which is why you were not seeing this issue previously.

The existing Canvas samples (to my knowledge) only cover the "Admin approved users are pre-authorized" behaviour and do not contain code to handle the "All users may self-authorize" behavior, but it is fairly simple to figure out if you have a good grasp of how OAuth works.

This is all covered in more detail in the Signed Request Authentication documentation.