3

We have an OAuth Web Server Flow setup in our SF managed package that is used to authenticate our web service with Salesforce for API access. When a user first opens our app in SF, a call is first made to the /services/oauth2/authorize endpoint with the client's Org ID and our client details. Salesforce then normally redirects the user to their remote access authorization page, asking the user to grant our app permission to access their org.

It seems that for a small few of our clients that are attempting to use our app within a sandbox, they get redirected to the Salesforce login page at test.salesforce.com, and entering their credentials simply logs them into Salesforce. Our callback URL is never sent the appropriate auth code.

It occurs somewhat rarely, as some sandboxes authorize without any issues.

Anyone have any ideas on how to diagnose this, or what might be happening?

Improve this question
2
  • Are they logged into browser where salesforce session Id still exists ?They can try in new browser where they are not logged into salesforce and see how system behaves .I have seen this issue and only way i handle is to clear cookies and browser cache
    – Mohith Shrivastava
    Commented May 8, 2015 at 19:17
  • I had them try it out in a few different browsers in incognito/private and with cookies cleared to no avail, unfortunately.
    – emroc
    Commented May 8, 2015 at 19:29

1 Answer 1

Reset to default
3

This is a problem with the salesforce session negotiation on sandbox orgs that use My Domain. There is no fix but a workaround is possible:

  1. upon arriving at the login page, don't login, but view the page source,

  2. locate the hidden input tag and value attribute by searching for "r=,

  3. copy the whole string after the = and paste it into an RFC URL decoder,

You now have the redirect URL that was supposed to go back to the org. And, regardless of having other browser sessions open or not (even in a chrome incognito window) one will see that the pod is wrong, for example it may show cs30 or cs17 even if your pod is cs1 in actuality.

Replace the wrong pod with the right pod, and paste that amended URL into the browser for it to complete the dance and return you into salesforce.

Improve this answer
2
  • 1
    Thanks, this worked great! Only thing to note was that the string wasn't Base64-encoded, it was simply a URL-encoded string.
    – emroc
    Commented May 11, 2015 at 13:51
  • @MikeRocha oops, ah derp... sorry for that! I keenly awaiting your upvote and accept :o)
    – Matt and Neil
    Commented May 11, 2015 at 13:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .