I am developing a salesforce mobile app. I want to create a customized login page to ask user to input username and password. I will use this username and password to call an external oauth service in order to call external web service. And behind the scene, I will hard code the same salesforce username and password for every user. Is this possible? If anyone can provide code example how to do this, that will be very helpful.
This idea defeats the purpose of oAuth and should be avoided. The point of oAuth is that 3rd party applications never handle passwords yet have permission to run as the logged in user. It also provides the user with the ability to revoke access from your application.
You are kinda talking about the OAuth password flow: http://wiki.developerforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com
But I don't necessarily disagree with Mike's statement. I'm a little confused about the need for a login page in this situation, and handling a random user's credentials on the third party side is, as Mike states, the anti-pattern OAuth means to solve.
I want to create a customized login page to ask user to input username and password
These guys are dead right, your desire is a little bit... edgy. I could speculatively answer if your intention were purely presentational, you could configure OAuth to improve the post-login experience?
play with the
displayparameter in the request, try:
in the 'Application' or 'Remote Access' configuration, try:
- custom image
- custom description
Some token branding - better than nothing?
I know this is an old post but could still be relevant to someone else - if the requirement is to continue with OAuth and just bypass the RemoteAccessAuthenticationPage, an option would be to re-configure the OAuth policy -'Permitted Users' to "Admin approved users are pre-authorized" instead of the default. Then you can nominate user profiles where the confirmation page will not appear. Yes, it is definitely a circumvention of the OAuth principle but it still follows the flow (and retains the security), only that there is an assumed acceptance of the user for the Connected App.
Please refer to this post as well: https://success.salesforce.com/answers?id=9063A000000icyoQAA