We are currently working creating a managed package which integrates with a third-party service through Canvas. The third-party service has different URLs for different users (similar to how Salesforce works with it's instances, i.e. na1, eu2, etc).
This is causing us issues as our Connected App definition must have a defined Canvas App URL.
We've come up with a couple of potential solutions, but we have no idea if these will work and/or pass the security review.
Create a redirect page which all requests go to, which then takes some information passed in the Canvas context and uses that to redirect the user to the appropriate URL.
- Will we have issues with XSS using this approach?
Use a Controller with a Custom Setting field to populate the
developerName attribute on the
apex:canvasApp tag, then as part of the post-install script get the user to create a Connected App, and then use the Custom Setting to refer to it.
- Is it possible to have a Visualforce Page within a Managed Package that refers to things outside of the package in this way, or will it only look for the
developerNamewithin it's own namespace?
- Will this pass security review? It will mean that we effectively have a lot of
apex:canvasAppcomponents that point to nothing until the Connect App is created and the Custom Setting exists.
Does anyone have any experience with doing anything similar? Will either of these approaches work and (importantly) pass the security review? Is there another option that we've not thought of?