5

I am developing a salesforce mobile app. I want to create a customized login page to ask user to input username and password. I will use this username and password to call an external oauth service in order to call external web service. And behind the scene, I will hard code the same salesforce username and password for every user. Is this possible? If anyone can provide code example how to do this, that will be very helpful.

  • Why would you use oAuth to authenticate but then use a service account behind the scenes? Why not just use the authenticated user's credentials? – Mike Chale Feb 28 '13 at 19:07
  • @Jie what technology stack is your mobile app? Native or HTML/JavaScript? Will you be phonegapping it or hosting it? – bigassforce Feb 28 '13 at 19:47
  • @user320 It will be a Android Hybrid app, so it will be HTML/JavaScript – Jie Feb 28 '13 at 20:33
  • 1
    I guess you are doing this because Salesforce do not expose unauthenticated Web Services? As indicated by @MikeChale, capturing user credentials is way off the reservation. Which services are you integrating? Can you invert the messaging? We need to find a different approach for this, otherwise it would be a disservice to your client. – bigassforce Feb 28 '13 at 20:55
4

This idea defeats the purpose of oAuth and should be avoided. The point of oAuth is that 3rd party applications never handle passwords yet have permission to run as the logged in user. It also provides the user with the ability to revoke access from your application.

  • I understand this is a bad idea in design, but it is a integration project for client, I have to call webservice from both sides, that's why i have to authenticate twice, but we only want customer login once – Jie Feb 28 '13 at 20:35
2

You are kinda talking about the OAuth password flow: http://wiki.developerforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com

But I don't necessarily disagree with Mike's statement. I'm a little confused about the need for a login page in this situation, and handling a random user's credentials on the third party side is, as Mike states, the anti-pattern OAuth means to solve.

  • 1
    StackExchange example of username-password flow here: salesforce.stackexchange.com/a/8211/320 </shameless> but your client must not disclose those credentials! – bigassforce Feb 28 '13 at 19:49
  • @user320 I already did password flow on their existing mobile app, they are using JS to call my endpoint, and I appended the sessionId to the call, now I need to do the same thing, I just want to know how to modify the salesforce oauth from the SDK sample app – Jie Feb 28 '13 at 20:41
  • Thanks @Jie! Please could you clarify that in your question? Because of the complexity involved, it will help to add some background about your implementation and your intentions. Otherwise it will be hard to assess whether your question is answered, or if what you want is even possible. :) – bigassforce Feb 28 '13 at 20:46
2

I want to create a customized login page to ask user to input username and password

These guys are dead right, your desire is a little bit... edgy. I could speculatively answer if your intention were purely presentational, you could configure OAuth to improve the post-login experience?

  1. play with the display parameter in the request, try:

    • page
    • popup
    • touch
    • mobile
  2. in the 'Application' or 'Remote Access' configuration, try:

    • custom image
    • custom description

Some token branding - better than nothing?

custom

  • But isn't that still the Salesforce oAuth page? You've just branded it, not circumvented it. – Mike Chale Feb 28 '13 at 19:39
  • 100% correct @MikeChale - I've missed the mark on this one. – bigassforce Feb 28 '13 at 19:48
  • @user320 The whole workflow is like this: 1. after the mobile activated, it shows a login page(not Salesforce oauth one), user enter external app(i call it installer) username, passwd 2. on the backend, i use password flow to oauth salesforce(i hard code the customer key and secret) 3. i store the username and passwd user just entered into salesforce 4. when user need to call a service ( get customer info from external database), i use the username and passwd to oauth him to external service and get response back [the pain is data and service is stored in 2 places] – Jie Feb 28 '13 at 23:01
  • @user320 By the way, how did you customized this page? If I can locate the controller and jsp page for Salesforce oAuth, I think it will solve my problem – Jie Mar 1 '13 at 1:09
  • By the way @Jie are these 2 places where the data is, Salesforce orgs? It might be possible to look at Single Sign On to bridge the second credential... – bigassforce Mar 1 '13 at 2:16
0

I know this is an old post but could still be relevant to someone else - if the requirement is to continue with OAuth and just bypass the RemoteAccessAuthenticationPage, an option would be to re-configure the OAuth policy -'Permitted Users' to "Admin approved users are pre-authorized" instead of the default. Then you can nominate user profiles where the confirmation page will not appear. Yes, it is definitely a circumvention of the OAuth principle but it still follows the flow (and retains the security), only that there is an assumed acceptance of the user for the Connected App.

Please refer to this post as well: https://success.salesforce.com/answers?id=9063A000000icyoQAA

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.