Hey guys I had a dream last night about a huge issue in our ability to aggregate data.

After setting up a remote app, using PHP to "CURL" into login.salesforce.com for authorization, we hit the Username/Password sequence. I see that this actuates frontdoor.jsp which in tern passes you to where you need to be (as long as app is accepted).

The question is how to POST through frontdoor.jsp so we will not have to manually enter a user/pass ?

I found THIS method, using http://login.salesforce.com?un=user@client.com&pw=xxxxxxxx which works, but in order to use it, I will need to return to my script....

Without using CURL, and trying to access via


give me the response error:

  <error_description>grant type not supported</error_description>

POST packet looks like this.

client_id       3MVG9A2kN3Bn17hv5JnQay9VirDF4FfYeGdVnwT0fP1AtVJoj3upT9ce7epjSmZPXsSkeX.o74fJ39Q.g9kv_
pw              xxxxxxxxxxxxxx
redirect_uri    https://sm-rdc-c-dev.foo.com/OAuthCallback.php
response_type   code
un              user@client.com

Instead of delegating to a human for credentials, you can use the Username-Password flow (where you securely store the credentials and a security token) - here's an example:

  1. Authenticate with credentials stored on your server (the response will be JSON, not frontdoor.jsp)

    $curl = curl_init();
    curl_setopt_array($curl, array(
      CURLOPT_URL            => 'https://login.salesforce.com/services/oauth2/token',
      CURLOPT_POST           => TRUE,
      CURLOPT_POSTFIELDS     => http_build_query(array(
      'grant_type'    => 'password',
      'client_id'     => '1234567890RVOvk4UFPhxrL09VocBGAf1vMcbM8cJOZUeZ0MroSMdT...',
      'client_secret' => '1234567891234567890',
      'username'      => 'herpderp@example.com',
      'password'      => 'secret' . 'SECURITYsioWgh8yZOnUtTOKEN',
    $response = json_decode(curl_exec($curl));
      'id'           => 'https://login.salesforce.com/id/00Dd01234567890/005d01234567890',
      'issued_at'    => '1359399973348',
      'instance_url' => 'https://na14.salesforce.com',
      'signature'    => '1234567890cqnL8rMv9HQX7zfdo3H3Mim1234567890=',
      'access_token' => '00Dd01234567890!AR8AQFPyjVdVPp62Q2ZlM3BG0Vm33iRJs3wMWqNuJsd...',
  2. Now use the Session ID to POST to your REST Web Service or whatever...

    $curl = curl_init();
    curl_setopt_array($curl, array(
      CURLOPT_URL            => $response->instance_url . '/services/apexrest/MyController',
      CURLOPT_POST           => TRUE,
      CURLOPT_HTTPHEADER     => array('Authorization: Bearer ' . $response->access_token),
    $response = curl_exec($curl);
| improve this answer | |
  • One quick question, will this let me aggregate data from the remote app that I have? – ehime Feb 7 '13 at 19:51
  • great question -- can you make a new post briefly outlining what you're doing, eg screen scrape etc? – bigassforce Feb 7 '13 at 21:17
  • added question: salesforce.stackexchange.com/questions/8255/… – ehime Feb 8 '13 at 16:36
  • Is there a way to do this when requesting a code? I tried https://login.salesforce.com/services/oauth2/authorize?response_type=code&username=name@domain.com&password=xxxxxxxxxxxxxxx&client_id=xxxxxxxxxxxxxx&redirect_uri=https://domain.com/callback.php to no avail =( – ehime Feb 8 '13 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.