We are developing a windows-based application that can work either offline or online.
When online, we want to use Salesforce to authenticate our users (Portal Users) and consume some REST services hosted there. Using OAuth and the Access Token is pretty straightforward.
When offline, we want to authenticate users using the same credentials as in Salesforce. For that purpose, we already have a vault with all best practices around offline credentials management (this is an existing application).
Our intent was to:
- Have a custom screen in the windows application to collect username/password
- Use the OAuth Username-Password flow to validate credentials
- If ok, keep credentials hashed in the vault
Unfortunately, we faced several issues:
- Salesforce does not support OAuth Usernane-Password flow for portal users.
- Other OAuth flows won't work: There's no way to have a view on the password
- SOAP Login does not provide an accessToken, so we would not be able to call REST services
What would be the most standard approach to that problem ?
Thanks a lot !