- Created a connected app on the hub org
- In the connected app Enabled OAuth Settings
- Provided full access and Perform requests on your behalf at any time (refresh_token, offline_access) oauth scope.
- provided a callback URL to a vf page
- Performed authoratization to get the summer 15 org authorization code.
- Pop up came to enter the target org's username and password.
- once entered , The connected app requested permission.
- Click allow. Instead of redirecting to the source org it tried to access the the redirect page on the target org.
- This issue appears when the target org is on summer 15. It worked fine with spring 15
You should use My Domain to provide a consistent domain name for your VF callback, like
https://companyname.my.salesforce.com/apex/vfpage_name. To be honest, I'm surprised it ever worked at all using
login.salesforce.com, since Salesforce will use whatever session is active session in deciding where to actually send the browser. This seems to be what's happening in Summer '15. I can't explain why it used to work.