Questions tagged [oauth]

OAuth is an open, standard, protocol to allow users to securely authorize web, mobile and desktop applications to access web services on their behalf. Salesforce supports OAuth 1.0a and 2.0.

Filter by
Sorted by
Tagged with
59
votes
2answers
21k views

What causes a Connected App's Refresh Token to expire?

We have configured our web application to use OAuth2 with our SFDC Connected App. The connected app is configured to never expire the refresh token unless manually revoked. When an admin connects the ...
18
votes
3answers
13k views

Salesforce: Any API for getting user information?

I am trying to find a way to get the information about the salesforce enterprise user from his auth_token. I want to find the username, email address and role(admin/user) from the auth-token. ...
11
votes
3answers
3k views

When does it make sense to add a Connected App to a Managed Package?

I think I'm familiar with the difference between a connected app definition and its consumption: As the vendor, my Connected App definition lives by himself in a dev org forever: For the users, in ...
11
votes
2answers
8k views

Redirect Uri Mismatch when URI's are the same

I've been dealing with this mismatch for the last two days, and am at my wits end. We have a development server set up (accessible from the outside), and I am trying to get my OAuth token back from my ...
11
votes
2answers
578 views

OAuth interactions: do they count as API calls?

OAuth token grants and token authorizations are human interactions that take place in the browser. And token refreshes happen to be machine interactions. Do any of the typical OAuth interactions count ...
9
votes
1answer
851 views

How is it that some OAuth-authenticated apps don't require an Org to create a Connect App in order to be installed?

As far as I can tell from the documentation you are required to created a Connected App (ex-Remote App) in order to use salesforce as the authentication authority. However there are apps that don't ...
9
votes
1answer
3k views

Authenticate 3rd party Application with OAuth2

The PHP getting started guide for interacting with Force.com seems to indicate that a user always needs to reauthenticate for each session with OAuth2, and that's my understanding of the protocol as ...
8
votes
1answer
5k views

Error using Session Id auth with cURL following REST documentation

Problem: trying to authenticate to a dev org using Session Id authentication and cURL fails when following the REST API Dev doc. The example in the doc provides the following, which fails (Quick Start ...
8
votes
1answer
9k views

Why do I get 'PKIX path building failed' exception with my callout?

Error message :PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Hello all please see the above ...
8
votes
1answer
25k views

What is the use of setting OAuth Callback URL as https://login.salesforce.com/services/oauth2/success?

I'm using Salesforce developer account and trying to obtain OAuth access token using curl and it returns 500 Server Error giving the message specified in [1]. Used curl command is curl -v -H "Content-...
8
votes
2answers
2k views

Using OAuth 1.0 encoded requests for external webservice calls

I have a business requirement that necessitates a callout from Apex to an external .NET based web service that receives signed OAuth responses. There is no built-in support for this in Apex, but ...
8
votes
1answer
1k views

OAuth within an iframe in salesforce

We are an ISV org and building out a new 'Text an Agent' feature. However the initial OAuth page is not being displayed in the iframe. In the picture below highlighted in the yellow box is the ...
7
votes
3answers
237 views

Security Review Oauth Callback “Insecure Storage of Sensitive Data”

I'm getting dinged in the security review for passing my package namespace prefix back in the state parameter of the OAuth callback. https://login.salesforce.com/services/oauth2/authorize?...
7
votes
1answer
822 views

OAuth - URL No Longer Exists

I am an ISV partner of SalesForce.com, I use OAuth between my Google App Engine service and my service on Force.com platform to transfer data. For some reason the handshake of OAuth needs to be ...
7
votes
1answer
1k views

Using a cloudforce.com login page for OAuth with a hybrid mobile app

Is it possible to use a cloudforce.com login page, e.g. https://example.cloudforce.com, to authenticate users with the PhoneGap OAuth plugin? The plugin is called from javascript using: PhoneGap....
7
votes
1answer
2k views

OAuth 2.0 JWT Bearer Token Flow giving a user hasn't approved this consumer error

I have setup a connected app and want to use the OAuth JWT. Based on my understanding of the salesforce documentation only preauthorized client can use this flow to get an access token. I have ...
7
votes
1answer
741 views

Mass-Edit records in Google Spreadsheet

Mass-Editing data in Salesforce is a pain. And even if tools like AppBuddy make this less click-intensive, none comes close to Excel or Google Spreadsheet. So I was just thinking if one could push ...
7
votes
0answers
244 views

Loading Static Resources When Accessing a Page WIth an OAuth Access Token

If you specify the 'web' scope for a connected app it's supposed to grant/provide access to Visualforce pages. I'm authenticating via the iOS mobile SDK and then attempting to use the access token I ...
6
votes
2answers
3k views

Pros and cons of user-agent flow vs web server flow

After looking into the different OAuth types and reading this question, I'm still confused on the specific pros and cons of user-agent vs web server flows. The best explanation I can find says that ...
6
votes
4answers
2k views

Oauth for Java native app

I have a Java native app I am trying to implement Oauth for. I have gone thru this article by Pat Patterson: http://wiki.developerforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com I am a ...
6
votes
3answers
3k views

Remote Access Apps (Production & Sandbox support)

A Remote Access record has a Client ID (key), Consumer Secret and Callback URL. To my knowledge, the proper callback URL for Salesforce is https://login.salesforce.com/services/oauth2/success. ...
6
votes
1answer
4k views

OAuth API doesn't send refresh token with custom redirect_uri

If I put this link in my web browser (I put them on separate lines for readability): https://login.salesforce.com/services/oauth2/authorize ?response_type=token &client_id=MY_CONSUMER_KEY &...
6
votes
3answers
11k views

Server-Side REST Authentication

We are trying to interface with our SalesForce instance via HTTP. The idea would be to call some of our custom classes from outside salesforce but without any user interaction. Typical scenario is ...
6
votes
1answer
900 views

Server to Server JWT Authentication Certificate management

I'm writing an application to sync some data from a service to salesforce and back. I'm working with a developer account and so far I was able to implement the bulk of the needed functionality merely ...
6
votes
1answer
1k views

salesforce saml bearer oauth flow

I am getting an invalid assertion 400 json response from salesforce when i try get an oauth access token using the saml bearer oauth grant flow. {"error_description":"invalid assertion","error":"...
6
votes
2answers
4k views

Salesforce oAuth login in popup or iFrame

I'm making an application that allows users to log in, and download a report generated from Salesforce with some additional fields specific for our environment (i.e. on top of normal FirstName, ...
5
votes
1answer
976 views

Custom Landing Page Once Logged in salesforce

I wish to create different custom landing pages for users based on their profile, after successful login through SalesForce. Is it possible to create? Provide your thoughts.
5
votes
4answers
4k views

Is there a way to get rid of Salesforce oAuth login page?

I am developing a salesforce mobile app. I want to create a customized login page to ask user to input username and password. I will use this username and password to call an external oauth service in ...
5
votes
1answer
4k views

Authentication Failure when submitting Authorization Code in OAuth Web-Server Flow

I am trying to test the Webserver OAuth as described here I can get the authorization code successfully by opening https://login.salesforce.com/services/oauth2/authorize?response_type=code&...
5
votes
1answer
1k views

Canvas App started sending GET instead of POST

I have a canvas app that is setup to use the signed request (POST) access method, and when I test the app via either the tab that it creates or the canvas app previewer it sends my webserver a POST ...
5
votes
1answer
2k views

Bypassing RemoteAccessAuthorizationPage when using a remote application?

Hey guys I had a dream last night about a huge issue in our ability to aggregate data. After setting up a remote app, using PHP to "CURL" into login.salesforce.com for authorization, we hit the ...
5
votes
1answer
1k views

Integrate SAML With A Hybrid App Built Using Mobile SDK

I have been developing apps using the Mobile SDK for a while now. All my apps till date use the built-in oAuth mechanism provided by the Mobile SDK for authentication. I have now encountered a use ...
5
votes
2answers
8k views

Issue with using OAuth token in REST API

I implemented the OAuth integration with my external app. Created a Remote Access(Connected App) configuration with a callback url (https://mysite.com/oauthcallback). Here I received the call back ...
5
votes
1answer
141 views

Storing OAuth Credentials

I have the following issue and need an advice on how to approach it. I connect to a third party system which generates a JWT token. The problem is that the token expires every 15 minutes and I'am not ...
5
votes
1answer
1k views

Named Credentials: How to Start OAuth flow?

I'm using Named Credentials with OAuth authentication. When calling a method on the endpoint, my Apex app receives back the status that the token needs to be refreshed. How do I tell Salesforce to ...
5
votes
1answer
58 views

Building a connected app without a production instance to store oAuth keys

I cannot find any reliable advice on the best approach to on oAuth secret keys when you do not have a production license. Background - I am creating an application that the community can use for free ...
5
votes
1answer
2k views

OAuth 2.0 JWT Bearer Token Flow

I'm trying to perform the OAuth 2.0 JWT Bearer Token Flow: https://help.salesforce.com/HTViewHelpDoc?id=remoteaccess_oauth_jwt_flow.htm&language=en_US But I'm having this issue: {"...
5
votes
1answer
340 views

How to intercept/hook into oauth flow

After a user authenticaes in our Org using the SSO oauth flow, and after the access token is created, we would like to hook into that flow to get that access token and set a couple of cookies. Is ...
5
votes
1answer
2k views

How to use Salesforce OAuth session ID for Metadata API?

I am using the REST API for my application. But I also need to use Metadata API. So for Metadata API calls I am trying to use the Session ID of OAuth authentication. For now I am able to use the ...
5
votes
1answer
349 views

Salesforce Platform Mobile Services

I've been doing force.com mobile development for several years now but I'm very confused about the nomenclature with some of the recent changes. 1) Is Salesforce Platform Mobile Services (recently ...
5
votes
1answer
917 views

Outbound OAuth callbacks

We are in the process of implementing an outbound OAuth integration to a third party app. Our customers will, from our managed package, OAuth authenticate to the third party app and we will then use ...
5
votes
1answer
956 views

Must I really use packages and a developer edition org simply to expose a JSON/REST API?

I have an org with a bunch of custom objects. I need to sync records of these objects with data from an external system. I want to expose a JSON/REST API to the external system and have it send ...
5
votes
1answer
334 views

Metadata API: where is the Connected App / OAuth policies / Permitted Users setting?

Salesforce.com setup screen has, in "Administer" section -> "Manage Apps" menu -> "Connected Apps" -> edit app page, a setting called "Permitted Users". This setting allows the portal administrator to ...
4
votes
3answers
433 views

accessing the Streaming API from a public-facing Force.com Site

I've got a telemetry application for which the Streaming API would be extremely useful. However I want the subscriptions to be publicly accessible. (So that anyone with the client can waltz up and ...
4
votes
3answers
39k views

Missing SOAP action header

Im trying to get the session ID of another user in the same org by sending the following request by using the data from my enterprise wsdl and its an developer edition. <?xml version="1.0" ...
4
votes
2answers
744 views

Determine If Sandbox from Instance URL in Javascript

There's been a few questions around working out if an org is a sandbox or not, but typically these are done via Apex. I need to find out an org's type (only sandbox/prod - dev etc. don't matter) using ...
4
votes
2answers
3k views

Why Salesforce oAuth Username Password flow does not need a security token?

When using SOAP API login call, we need security token or the public IP should be white listed. Why not when we use the connected APP Username Password flow (UP flow)? If you compare the security ...
4
votes
1answer
133 views

Tie web server oauth to user session in my canvas app

I'm trying to figure out how to allow my users to login to my app using only Salesforce. I think I want to use the "web server oauth flow" and follow the directions in the solution here: https://...
4
votes
2answers
2k views

Making rest request with Oauth

I have all four Oauth token consumerKey, consumerSecret, accessKey and accessSecret. I need to make a request to a url from my apex code. Is there any library or a way to make this request. In java I ...
4
votes
1answer
1k views

Callback URL for Deep destination in Connected App

We have a connected app and using oAuth. The requested URL is a resource within a connected app...so not the home page. It is dynamic so, it can request any page within the target app. How can we ...