Offline authentication

Question

We are developing a windows-based application that can work either offline or online.

• When online, we want to use Salesforce to authenticate our users (Portal Users) and consume some REST services hosted there. Using OAuth and the Access Token is pretty straightforward.

• When offline, we want to authenticate users using the same credentials as in Salesforce. For that purpose, we already have a vault with all best practices around offline credentials management (this is an existing application).

Our intent was to:

• Have a custom screen in the windows application to collect username/password
• Use the OAuth Username-Password flow to validate credentials
• If ok, keep credentials hashed in the vault

Unfortunately, we faced several issues:

• Salesforce does not support OAuth Usernane-Password flow for portal users.
• Other OAuth flows won't work: There's no way to have a view on the password
• SOAP Login does not provide an accessToken, so we would not be able to call REST services

What would be the most standard approach to that problem ?

Thanks a lot !

Answer 1

Have you considered creating a connected app and using the Force.com Toolkit for .NET, I believe it will resolve some of your issues related to oAuth. There is also a sample example which explains how the oAuth flow works

A sample oAuth flow would look something like

private readonly string _consumerKey = ConfigurationManager.AppSettings["ConsumerKey"];
        private readonly string _consumerSecret = ConfigurationManager.AppSettings["ConsumerSecret"];
        private readonly string _callbackUrl = ConfigurationManager.AppSettings["CallbackUrl"];
        private readonly string _tokenRequestEndpointUrl = ConfigurationManager.AppSettings["TokenRequestEndpointUrl"];

        public async Task<HttpResponseMessage> Get(string display, string code)
        {
            var auth = new AuthenticationClient();
            await auth.WebServerAsync(_consumerKey, _consumerSecret, _callbackUrl, code, _tokenRequestEndpointUrl);

            var url = string.Format("/?token={0}&api={1}&instance_url={2}", auth.AccessToken, auth.ApiVersion,
                auth.InstanceUrl);

            var response = new HttpResponseMessage(HttpStatusCode.Redirect);
            response.Headers.Location = new Uri(url, UriKind.Relative);

            return response;
        }

Coming to your other questions

Salesforce does not support OAuth Usernane-Password flow for portal users.

This is not true. You can refer this tutorial for how to get oAuth working for portal users.

Other OAuth flows won't work: There's no way to have a view on the password

Not sure what you mean here but once the oAuth flow works, you have the tokens to perform other operations as requird

SOAP Login does not provide an accessToken, so we would not be able to call REST services

The .NET toolkit uses REST so IMO, this should not be a problem.