8

Fill the field 'User Info Endpoint URL' (on Auth provider page ) with this and test it out. https://graph.facebook.com/me?fields=first_name,last_name,email Reason for suggestion is: Facebook api v2.2, 2.3 returns first name, last name, email etc by default. Facebook api v2.4 and later versions don't return these fields unless we specify /me?fields=...


6

Make sure your AuthProvider name has no spaces. I was able to pull the metadata using the retrieve command: sfdx force:source:retrieve -m AuthProvider However, your subsequent pull commands will continue to fail because it cannot find the AuthProvider. If you rename it replacing spaces with underscores (Name and URL Suffix will both have no special chars)...


6

Just an update for anyone facing the same issue. After raising a case with SF we could confirm that the refresh function is only triggered to get new session Id in case the previous callout return '401' status code only (Only way for SF to know that the session is expired)


6

I've written a custom authprovider which I've shared "as-is" on Github. It implements both the Client Credentials and JWT Bearer variant (without a certificate). Feel free to fork from it. https://github.com/bobbywhitesfdc/ApigeeAuthProvider


6

Auth Provider is org specific. It has a callback URL where a connected app redirects after authentication and org get authcode and complete the rest authentication steps. If salesforce allows Auth Provider to be packaged then redirect url will be same (same as packaging org) for all the subscriber orgs and it will redirect incorrectly to packaging org ...


5

You cannot write an initiate method for a Custom Auth Provider without returning a valid PageReference object (i.e. redirect page). Salesforce configuration for Named Credential with a Custom Authentication Provider appears to be limited to the OAuth 2.0 Authorization Code Grant Type only. I don't believe that Salesforce has officially documented this key ...


5

What it looks like you're attempting to do is login to a community via Salesforce SSO and Auth Providers using credentials from that org, and this is not allowed. Your Salesforce instance that serves as your identity provider must be a different org than the one hosting your community. Attempting to sign in to the community using credentials from the org ...


4

In general, for oauth to work, the user needs to authorise salesforce to perform requests on their behalf. If you haven't done it already, I suggest you go through the documentation on the many different types of oauth flows, and see if one of them fits your scenario. https://help.salesforce.com/articleView?id=remoteaccess_authenticate_overview.htm ...


3

Not all objects allow DML in Apex, even if they are allowed in SOAP, REST, etc. I'm not entirely sure why this restriction exists, but when it does, there's not much you can do. In some contexts, you can choose to call a REST API call (e.g. DELETE /services/data/47.9/sobjects/AuthProvider/{recordid}), though it depends on your current context. HttpRequest ...


3

I was able to authenticate my OAuth 2.0 with the following configuration. For the Auth. provider my Endpoint URL was: https://auth.atlassian.com/authorize?audience=api.atlassian.com My token endpoint was https://auth.atlassian.com/oauth/token My default scopes were: read:jira-work manage:jira-project manage:jira-configuration read:jira-user write:...


3

What is wrong with the above configuration? The Sandbox Org Auth. Provider should have been configured to use: Authorize Endpoint URL: https://login.salesforce.com/services/oauth2/authorize Token Endpoint URL: https://login.salesforce.com/services/oauth2/token Which are the URLs for production login, allowing me to authenticate against the Production Org ...


3

I had the same problem. I found that callback url in the connected app should be the same as you have in your redirect_uri. I tested it with a tool called postman, maybe that can help you as well.


3

Metadaddy is on the right track here. It's a bit nuanced, but here we go: When logging into Salesforce you can really have multiple contexts. The default is logging into the Org. You do this from login.salesforce.com, your My Domain, or perhaps from an enterprise single sign-on service. Here's where you access apps like Sales, Service, or custom apps on ...


3

It sounds like you already have your Facebook user linked to a Salesforce Community (= Portal) user, and now you're trying to log him in as an internal user. A given FB user cannot be both. To fix this, and test SSO as an internal user, you can break that user's link from FB to Salesforce. Log into the org as an admin, then go to that user's record, scroll ...


3

Salesforce closely follows the Oauth2.0 spec for a Named Credential OAuth2.0 flow. When you save and start the Authentication flow, the page reference method initiate is called where your class has the URL to navigate to and complete the Oauth2.0 flow. Once Authentication is successful the callback method handleCallback should have the logic to invoke the ...


3

Edited I did some tests with your code and setup in a Developer Org, Test 1: Log in as the user who created the Auth. Provider in Workbench Result: I can get the token in workbench. Test 2: Grant apex class access to a site and visit the site Result: I got a null as a site user. Test 3: Log in as another System Admin in Workbench Result: I got a null I ...


3

A Named Credential can issue a JWT out of the box (see this answer for more details on how it works) HttpRequest req = new HttpRequest(); req.setEndpoint('callout:MyJWT/some_path'); req.setMethod('POST'); Http http = new Http(); HTTPResponse res = http.send(req); System.debug(res.getBody()); If you need more flexibility with payload, use Auth.JWT class: ...


2

This one is my mistake :( It seems like the redirect is based upon the referrer of the request, and has nothing to do with the community parameter. I was testing this by putting /services/auth/sso endpoint in my address bar, in which case the redirect is indeed always to the force.com domain. Put a link on your site to /services/auth/sso and it will ...


2

I think you need to use the site parameter, eg: https://login.salesforce.com /services/auth/sso /[your_org_id] /[your_auth_provider] ?site=http%3A%2F%2Fmysite.com%2F &startURL=[relative_start_url] https://help.salesforce.com/HTViewHelpDoc?id=sso_authentication_providers.htm&language=en_US Site - Enables the provider to be used with a site


2

I fixed it by updating Consumer Key.I didn't copied Consumer Key properly on Auth. provider in Destination org.After updating it and saving Named Credentials and new page opens up to authenticate Source Org and finally updated the Authentication Status to username of source org.


2

I just found the article again to get an Auth. Providers SSO Init URL: AuthConfiguration Class AuthConfiguration class has a static method getAuthProviderSsoUrl(communityUrl, startUrl, 'developerName'); It build you the SSO Login URL including the community and startURL parameter. If you set both communityUrl and startUrl method parameters to NULL, it ...


2

I spent a little time trying to figure out how to get LinkedIn to work with the OpenID auth provider as well. While it does support OAuth2, it turns out that LinkedIn doesn't seem to support OpenID. On one of the webinars recently they mentioned that (Safe Harbor) LinkedIn Auth Provider might show up at the end of the year (similar to how Facebook has its ...


2

Based on the information provided, I suspect that your Auth Provider URL is not setup correctly. It needs to be in this format https://login.salesforce.com/services/auth/sso/00D30000000000FOO/Facebook?community=http%3A%2F%2Fcustomerdemo.force.com&startURL= The important piece is the community param with your URL, plus an optional start url. This will ...


2

Salesforce Premier Support has stated: The Custom Auth provider set up in Salesforce would not allow you to enter client credentials and login. The two posts below also confirm this: Custom Auth Provider usage for unattended OAuth flow Named Credentials and support for the OAuth2 Client Credentials Grant Type and alternatives As a solution to the ...


2

I was able to selectively pull the problematic metadata using this plugin https://www.npmjs.com/package/@rohanatgwcs/sfdx-selective-retrieve-deploy sfdx gs:source:pull --type AuthProvider --names MyProvider --targetdir force-app/main/default/authProvider


2

Go to Setup > (Company Settings | Domain Management) > My Domain, edit the Authentication Configuration section, and uncheck all settings except for the provider you want to use. Salesforce will then automatically redirect all login requests from your domain to the specified provider. If more than one option is available, users can choose from any of the ...


2

You got to encode those curley brackets and quotes. They're not listed in the characters that should not be encoded. https://en.wikipedia.org/wiki/Percent-encoding https://stackoverflow.com/questions/27577922/how-to-pass-a-json-array-as-a-parameter-in-url


2

Auth.AuthToken.getAccessToken(String authProviderId, String providerName) can get the access token from the auth provider. The call to getAccessToken is made within the currently established security context. That is, if ESB calls Salesforce via whatever API and authorizes this call as user Foo, the call to getAccessToken will retrieve the token for user Foo....


1

For me it worked: UserData should contains at least an empty Map of attributes(the last paramter in constructor). Otherwise you will recieve Internal Server error.


1

You need to Modify the app settings and set the app domain (or Home Page URL) to Salesforce. Please follow below steps from the link below. https://help.salesforce.com/articleView?id=sso_provider_openid_connect.htm&type=5 I have posted complete steps from above link Complete these steps to configure an OpenID authentication provider. Register your ...


Only top voted, non community-wiki answers of a minimum length are eligible