56
votes
Accepted
Use a Named Credential with API key?
Well... sort of. The only two officially supported methods are by Basic Authentication and OAuth tokens. That site uses a non-standard API design, so it can't directly benefit from using a Named ...
- 481k
27
votes
Accepted
Mavensmate: Getting error client identifier invalid while authentication to salesforce
To those hacking MavensMate's source code to keep it alive: I strongly recommend you migrate to official Salesforce tooling, namely the VS Code extensions for Salesforce.
MavensMate's codebase has ...
- 286
20
votes
Accepted
Pros and cons of user-agent flow vs web server flow
The User Agent (UA) and Web Server (WS) flows have two different security purposes. The main difference is that UA is used for untrusted clients, while WS is used for a server application; the WS uses ...
- 481k
17
votes
Accepted
What is "Sfdx Auth Url" attribute used for?
The SFDX URL can be used to authenticate to the Salesforce CLI without needing any JWT Token or using the browser to key in the credential.
In fact it is the easiest way to authenticate through CLI. ...
- 90.4k
11
votes
error=redirect_uri_mismatch&error_description=redirect_uri%20must%20match%20configuration
I had the same problem. I found that callback url in the connected app should be the same as you have in your redirect_uri.
I tested it with a tool called postman, maybe that can help you as well.
- 665
10
votes
Two factor authentication for Community Users
Two Factor Authentication is supported for Community Users as pointed out by Rob Cowell.
For standard user license type, you my be accustomed to enabling 2FA via the System Permission Two-Factor ...
- 4,156
9
votes
Accepted
How can I avoid Salesforce expiring my password and/or token without warning?
Your token didn't expire, your password did. As an administrator, you can make a Permission Set with the Password Never Expires permission, and assign it to your user account (affects only yourself), ...
- 481k
9
votes
Accepted
Salesforce Server-To-Server API authentication
I believe the JWT Bearer OAuth 2.0 flow is the way to go here.
There is some setup involved (you need to generate/use an X509 certificate, use the user-agent or web-server flows to authorize once), ...
- 59.3k
9
votes
Mavensmate: Getting error client identifier invalid while authentication to salesforce
MavensMate has reached its End Of Life. The connected app that it used to authenticate with Salesforce has been decommissioned, as indicated by the OAuth failure you see.
There is the chance it could ...
- 291
8
votes
Facebook as Auth Provider - no username or email passed in Auth.Data
Fill the field 'User Info Endpoint URL' (on Auth provider page ) with this and test it out.
https://graph.facebook.com/me?fields=first_name,last_name,email
Reason for suggestion is:
Facebook api v2....
- 81
8
votes
Accepted
Is there a better way to do two-factor authentication?
There's two main ways to use 2FA. The first is where you enter a code each time you log in, and the second is where you authenticate the login through a mobile app. If you install the Salesforce ...
- 481k
7
votes
Accepted
How do I authorize access to a managed application in another org?
I just went through something similar where the final destination varied depending on the customer so a static callback int he code did not work.
What I did on our LMA org to handle this was:
Placed ...
- 54k
7
votes
Accepted
How is this possible to use the Salesforce CLI after changing my user's password?
Salesforce CLI use an access token to connect to your org. This means that even if you change your password or even your username it will still be connected to your org trough your username. If you ...
- 752
7
votes
Determine whether running user is logged in from within Trusted IP Range (from Apex)
You can accomplish this with Auth.SessionManagement class methods. The code below sets the isTrustedIp variable based on whether or not the running user's IP address is in the trusted ranges (as ...
- 3,074
7
votes
Mavensmate: Getting error client identifier invalid while authentication to salesforce
As Joe mentioned above, Mavensmate suffered from a serious CSRF & CORS vulnerability (conceived by @ralph-callaway; confirmed by myself) where any website could make requests against the localhost ...
- 10k
7
votes
Accepted
Testing Community "Passwordless Login" using the System.UserManagement Class
I think the sad truth is that there is currently (as at v47.0) no support in Apex for testing those methods or the corresponding TwoFactorMethodsInfo API. I'm asking around for verification, but the ...
- 102k
6
votes
Two factor authentication for Community Users
At the time of writing (Mar 2016), I believe Two-factor is available for Community Users, based on what I'm seeing at https://help.salesforce.com/HTViewHelpDoc?id=two_factor_auth_for_sso_and_saml.htm&...
- 970
6
votes
Accepted
When to use username & password flow to obtain a token
The username-password flow is only intended for development. It is insecure and should never be used for a production application. As this help topic helpfully warns:
This OAuth authentication flow ...
- 481k
6
votes
Accepted
Using basic http authentication to authorize connection
You can't use Basic Authentication with Salesforce. Instead, use the SOAP login() call or the OAuth Username-Password authentication flow.
- 481k
6
votes
Accepted
Sandbox verification emails
Have a look at the SandboxPostCopy Interface. It should be possible to have Apex run after the Sandbox is created and then modify the specific User records email address fields.
- 102k
6
votes
What method to use in a batch apex in order to get authentication token from a remote server?
I just had a similar requirement that I'm filling by using Platform Cache to hold the token and its expiration timestamp. It looks basically like this:
public class WSAuthentication {
public ...
- 5,730
6
votes
Accepted
How does a website that accesses my salesforce metadata/data authorize against my org?
Connected Apps are "global metadata". They don't need to be present in the target org, just in a single, persistent org that you control.
If you maintain that Connected App in your own org, you can ...
- 92.1k
5
votes
OpenID Connect with custom IdP: AuthorizationError: No_Oauth_Token/Empty Response
Just wanted to note that I've managed to acquire a response from Salesforce's support. They confirmed that in their current implementation of OpenID Connect client it will reject self-signed ...
- 81
5
votes
Accessing Named Credentials' data in apex
One option is to use Merge Fields for Apex Callouts That Use Named Credentials. This won't explicitly give you access to the data from the named credential in Apex, but it will allow you to alter how ...
- 102k
5
votes
[API][CORS] Not able to use API despite domain being whitelisted
It seems you're trying to authenticate using the CORS request which isn't supported - see this comment for more details. You should be able to use it for any other API requests though - that will also ...
- 15.5k
5
votes
Accepted
"Unable to resolve request into a Service Provider" return by Salesforce Identity Provider for SAML 2.0 request
This usually has to do with the Entity ID field being incorrect in the Service Provider's Single Sign-On Configuration. Make sure it's the Service Provider's domain URL, not the Identity Provider's ...
- 1,029
5
votes
Two factor authentication for Community Users
You are correct, Two-Factor Authentication is not available for users with a Partner Community or Customer Community license.
However, there is a no-code workaround: you can implement Two-Factor ...
- 9,523
5
votes
Using SAML to authenticate user for a force.com site
If I understand your question correctly, this should be the approach you should be following. Force.com sites do support SSO using SAML.
You need to provide the following info for your identity ...
- 15.5k
5
votes
Accepted
Server to Server JWT Authentication Certificate management
The JWT Authentication Flow can be initiaded using the usual OAuth2 Authorization Flow.
Setup:
Setup the App, get the required client_key and client_secret Build > Create > Apps
Create a new Keypair ...
- 161
5
votes
REST API server-to-server communication
I would rather use the OAuth 2.0 JWT Bearer Token Flow.
The only prerequisite is to have on both servers the same certificate for:
at your server side, sign the request using the private key of ...
- 71
Only top scored, non community-wiki answers of a minimum length are eligible