Overview: Mobile device (call service on ESB) —> ESB (calls salesforce API to get data) —> Salesforce.Mobile devices and Salesforce supported by the same IdM system.
Description: A custom API exposing certain salesforce functions is developed on a service bus (this internally makes use of Force.com APIs). A mobile device authenticates itself with an IdM system (used by salesforce as well). This would return a SAML assertion to the mobile device. After authentication, a call is made from the mobile device to the custom API on the esb to access salesforce data for the user logged in to the mobile device. Now in this scenario we need the salesforce API calls to look like its coming from the user logged into the mobile device in order to retrieve the salesforce entities relevant to that user. This will also hopefully preserve auditing within salesforce against that user. But at the same time, the call into salesforce is actually made by the ESB and we would like to differentiate/highlight the calls made by the ESB as a service account from actual calls by the user. In other weds, we would like some way of making the actual API call with a service account and then passing in the user data within the payload somehow to retrieve data relevant to the user context and also preserve auditing in salesforce etc. Is this even possible?
Apologies if this is a little wooly but not sure how else to phrase it as its only a high level thinking at the moment and would like to know if this is conceptually possible? Happy to answer questions to refine this a little. Also, when salesforce UI makes a call to get backend data, does it actually the use the same API as publicly available?