I want to allow customers who are already logged into my companies portal via SSO, (written in PHP and hosted on our own webserver) to access salesforce information. The end user will already be authenticated for our SFDC community by way of SSO, but I want my web app to be able to access SFDC data on their behalf without having to get the user to authorise the "connected app". i.e. I want to access the Chatter API, but I don't want end users to have to authorise the website via the SFDC page. (many of them don't even know that we use SFDC and that the chatter feed they will be seeing is part of our internal SFDC implementation).

Is this possible? I read the "Getting Started with the Force.com REST API" guide on developer.salesforce.com but don't really understand the part around authorisation/authentication. Essentially, I want to pre-authorise users of my choice...


Yes, administrators can "pre-authorize" an app. Go to the connected app settings (Settings > Manage Apps > Connected Apps), and under the OAuth Policies section, choose "Admin approved users are pre-authorized" under "Permitted Users". Afterwards, you'll need to edit each profile and check the permission in the Connected App Access section. You can also use the Metadata API to mass-edit those profile permission as well, if you prefer. Once done, all users with approved profiles can login automatically without granting access.

However, since they already have a session via SSO, you probably don't even need to do this. You can just use the session ID provided by the SSO implementation. In general, you can use any valid session ID for the API, unless that session ID has specific restrictions in place (e.g. if you login with a limited scope, some features may not be available). As far as I'm aware, any SOAP or browser session ID is valid for API access. You might not even need to use a connected app since users are already logged in.

Pre-authorized profiles can be set up programmatically using the SetupEntityAccess object:

insert new SetupEntityAccess(
  SetupEntityId = '0H4000000000000', //Connected Application ID
  ParentId = '0PS000000000000' //Permission Set ID (profiles have shadow records)
  • that's great. I did already try to get the session ID as you describe, but these are community users, and don't appear to have a session ID set? (unless I'm going about getting it the wrong way). Also, they may not necessarily have a session ID, as they may not have visited SFDC to create the session (they do however have a SAML assertion in their browser which would authenticate them) Jun 22 '15 at 15:29
  • 1
    @kingmunkyman Was just a suggestion. But you can pre-authorize them as I stated, so that they won't know about the interstitial step.
    – sfdcfox
    Jun 22 '15 at 16:06
  • App Visibility is available in Metadata API but not Connected App Access :( Jun 29 '18 at 9:22
  • 2
    @bigassforce It's actually a weird metadata thing; you insert and delete them like normal records. See the SetupEntityAccess object for more information. You need to query the Id for the PermissionSet for the Profile and the Connected App, then insert a new SetupEntityAccess record with ParentId and SetupEntityId specified.
    – sfdcfox
    Jun 30 '18 at 14:48
  • 1
    @Edmondo1984 the default mode, if I remember it right, is to allow all users, even if configured as Admin Users Are Pre-Authorized in the original org. Have you tried it?
    – sfdcfox
    Apr 29 '19 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.