I want to allow customers who are already logged into my companies portal via SSO, (written in PHP and hosted on our own webserver) to access salesforce information. The end user will already be authenticated for our SFDC community by way of SSO, but I want my web app to be able to access SFDC data on their behalf without having to get the user to authorise the "connected app". i.e. I want to access the Chatter API, but I don't want end users to have to authorise the website via the SFDC page. (many of them don't even know that we use SFDC and that the chatter feed they will be seeing is part of our internal SFDC implementation).

Is this possible? I read the "Getting Started with the Force.com REST API" guide on developer.salesforce.com but don't really understand the part around authorisation/authentication. Essentially, I want to pre-authorise users of my choice...

1 Answer 1


Yes, administrators can "pre-authorize" an app. Go to the connected app settings (Settings > Manage Apps > Connected Apps), and under the OAuth Policies section, choose "Admin approved users are pre-authorized" under "Permitted Users". Afterwards, you'll need to edit each profile and check the permission in the Connected App Access section. You can also use the Metadata API to mass-edit those profile permission as well, if you prefer. Once done, all users with approved profiles can login automatically without granting access.

However, since they already have a session via SSO, you probably don't even need to do this. You can just use the session ID provided by the SSO implementation. In general, you can use any valid session ID for the API, unless that session ID has specific restrictions in place (e.g. if you login with a limited scope, some features may not be available). As far as I'm aware, any SOAP or browser session ID is valid for API access. You might not even need to use a connected app since users are already logged in.

Pre-authorized profiles can be set up programmatically using the SetupEntityAccess object:

insert new SetupEntityAccess(
  SetupEntityId = '0H4000000000000', //Connected Application ID
  ParentId = '0PS000000000000' //Permission Set ID (profiles have shadow records)
  • that's great. I did already try to get the session ID as you describe, but these are community users, and don't appear to have a session ID set? (unless I'm going about getting it the wrong way). Also, they may not necessarily have a session ID, as they may not have visited SFDC to create the session (they do however have a SAML assertion in their browser which would authenticate them)
    – Dan
    Commented Jun 22, 2015 at 15:29
  • 1
    @kingmunkyman Was just a suggestion. But you can pre-authorize them as I stated, so that they won't know about the interstitial step.
    – sfdcfox
    Commented Jun 22, 2015 at 16:06
  • 2
    @bigassforce It's actually a weird metadata thing; you insert and delete them like normal records. See the SetupEntityAccess object for more information. You need to query the Id for the PermissionSet for the Profile and the Connected App, then insert a new SetupEntityAccess record with ParentId and SetupEntityId specified.
    – sfdcfox
    Commented Jun 30, 2018 at 14:48
  • 1
    @Edmondo1984 the default mode, if I remember it right, is to allow all users, even if configured as Admin Users Are Pre-Authorized in the original org. Have you tried it?
    – sfdcfox
    Commented Apr 29, 2019 at 14:57
  • 1
    @Edmondo here's a playwright script I've used - gist.github.com/sjurgis/287d3ede6aeb0ec9f8123cb7f5adf84b Took me a while to get it right, but it works (well, at least it did one year ago)
    – dzh
    Commented Jul 4, 2023 at 23:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .