1

We allow our Salesforce customers to login to our own Salesforce Service Community by using OAuth ("Login with Salesforce"). To do so, we created in our customer's org a Connected App, set the Callback URL correctly and entered the Client ID/Secret on our side in an Auth. Provider. Everything works smoothly when logging in.

But now I realized that even users from other orgs (without having the Connected App set up!) can "Login with Salesforce".

This means for us, that we need to implement a user validation mechanism in our Registration Handler, to "filter" those who are allowed to login and those who are not.

Until now, I expected that this would be done during communication between Auth. Provider and Connected App.

Is there any way to prevent users to login without having the Connected App (+the correct Client ID/Secret)?

Improve this question

1 Answer 1

Reset to default
2

The way OAuth and connected apps work is that, by default you only need to define the connected app once, and users can use it from any org. Additional controls are on the user org side ('which apps can my users use'), so you will need to validate users in your app.

If you know the IDs for the permitted orgs, you could parse the incoming user's org ID from the id attribute in the OAuth response and test that.

If this is an AppExchange app, you could also look at leveraging LMA.

Improve this answer
2
  • So, if I would create the Connected App in the same org as the Auth. Provider (basically the "3rd-party application" the users log in to), would this be sufficient?
    – nisseknudsen
    Jun 9, 2015 at 13:36
  • Yes. You only need to create a single connected app. Any org with users who use the connected app will be able to manage their use.
    – metadaddy
    Jun 10, 2015 at 22:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .