0

I am building a .NET web application that authenticates Salesforce users using OAuth 2.0. Following the guide here, I was able to implement the web-server flow. However, now that I am getting farther along I decided to make a "launcher" Visualforce page that is available to the traditional Salesforce UI in addition to Salesforce1. This page has a button that the user clicks to open a new window to my application. My application then sends the user through https://login.salesforce.com/service/oauth2/authorize. After authentication, they are redirected back to my application with an OAuth token.

The problem with Salesforce1 for Android is that a Chrome browser window is opened when the user clicks the launch button in the Visualforce page. My application redirects them to the authorization url listed above, only now since they are no longer in the Salesforce1 app, they are asked to re-login to Salesforce through their browser. This seems less than optimal since they are already logged in through the native Android app. Is there a way to handle this type of authentication such that the user is not forced to re-authenticate from their web-browser?

Improve this question

2 Answers 2

Reset to default
1

Assuming that you are logged in Salesforce1 app and want to authenticate with C# application using the same token.

You can use frontdoor.jsp approach. In you app create an url for button like this:

 https://instance.salesforce.com/secur/frontdoor.jsp?sid=access_token&retURL=OAUTH_URL&startURL=OAUTH_URL

OAUTH_URL must be URL Encoded and OAUTH_URL would be like https://login.salesforce.com/service/oauth2/authorize

Note: You have to provide web scope in OAuth flow. Also, I have not tested it in practical but sure that frontdoor.jsp will log you in salesforce without promting username and password.

Improve this answer
1
  • Hi Ashwani. That is actually not a bad idea :) I might re-work the flow such that the startURL is set to my VF page with a parameter denoting that the redirect was successful. The tricky part from here is figuring out whether to send users to frontdoor.jsp or link them directly to my app. I would only want to send them to frontdoor.jsp if they are using a native app. Perhaps that is a stand-alone question in itself.
    – dana
    Aug 14, 2015 at 16:08
1

I ended up doing something completely different. The cleanest solution for me was to use the older method of SSO by passing the following VF merge tokens to my app: $Api.Partner_Server_URL_xxx and $Api.Session_ID.

I spoke to the ISV team and they suggested using the sforce.one.navigateToUrl call to redirect the user to my app from within Salesforce1. The reason for this is because my app is on a different domain, and the navigateToUrl call opens a new window regardless of how Salesforce1 is being accessed. I have not gone through a security review yet, so I cannot confirm as to whether this approach will pass. But in the past I have used this approach and was able to pass the security review, so we will see if things have changed.

My preference would of course be to use the new OAuth approach, but given the nature of using sforce.one.navigateToUrl to open a new window, I do not see how to send over an authenticated user without merging in their session id. This works if you are using the Salesforce1 browser, but if using a native app on either Android or iOS, the user is asked to login to Salesforce.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .