48
votes
Accepted
Use a Named Credential with API key?
Well... sort of. The only two officially supported methods are by Basic Authentication and OAuth tokens. That site uses a non-standard API design, so it can't directly benefit from using a Named ...
- 433k
27
votes
Accepted
Mavensmate: Getting error client identifier invalid while authentication to salesforce
To those hacking MavensMate's source code to keep it alive: I strongly recommend you migrate to official Salesforce tooling, namely the VS Code extensions for Salesforce.
MavensMate's codebase has ...
- 286
21
votes
Accepted
When does it make sense to add a Connected App to a Managed Package?
Packaging the connected app allows administrators who install the app to control which of their users can use the application.
Rather than the coarse ability to block or not block an app (seen in ...
- 2,499
17
votes
Accepted
Pros and cons of user-agent flow vs web server flow
The User Agent (UA) and Web Server (WS) flows have two different security purposes. The main difference is that UA is used for untrusted clients, while WS is used for a server application; the WS uses ...
- 433k
14
votes
Accepted
What is "Sfdx Auth Url" attribute used for?
The SFDX URL can be used to authenticate to the Salesforce CLI without needing any JWT Token or using the browser to key in the credential.
In fact it is the easiest way to authenticate through CLI. ...
- 86.3k
12
votes
Accepted
Salesforce certificate authentication for users
It's possible using the Mutual authentication feature which allows you to setup certificates for users so they are authenticated via a certificate instead of a username/password. Please note that this ...
- 15.5k
12
votes
Accepted
How does lightning authentication work?
There has been a lot of discussion around speed of development and reusable components and while I do think we get decent marks for that the real promise of lightning components is that for the first ...
- 9,974
9
votes
"Session expired or invalid" problem calling an @RestResource from Apex in Winter '15 preview; UserInfo.getSession returns null for Force.com Sites
Support have come back with:
confirmed with R&D that this is not a BUG rather a security update
that is introduced in Winter'15 release
and advise:
affected customers will need to adjust ...
- 130k
9
votes
Two factor authentication for Community Users
Two Factor Authentication is supported for Community Users as pointed out by Rob Cowell.
For standard user license type, you my be accustomed to enabling 2FA via the System Permission Two-Factor ...
- 3,976
9
votes
Accepted
How can I avoid Salesforce expiring my password and/or token without warning?
Your token didn't expire, your password did. As an administrator, you can make a Permission Set with the Password Never Expires permission, and assign it to your user account (affects only yourself), ...
- 433k
9
votes
Mavensmate: Getting error client identifier invalid while authentication to salesforce
MavensMate has reached its End Of Life. The connected app that it used to authenticate with Salesforce has been decommissioned, as indicated by the OAuth failure you see.
There is the chance it could ...
- 291
8
votes
Accepted
frontdoor.jsp for Customer Portal user? How to authenticate a portal user with session id?
This discussion forum thread suggests that you can do this with
https://<instance>.salesforce.com/secur/frontdoor.jsp?sid=<sessionId>&orgId=<orgId>&portalId=<portalId>
...
- 16.2k
8
votes
Facebook as Auth Provider - no username or email passed in Auth.Data
Fill the field 'User Info Endpoint URL' (on Auth provider page ) with this and test it out.
https://graph.facebook.com/me?fields=first_name,last_name,email
Reason for suggestion is:
Facebook api v2....
- 81
8
votes
Accepted
Is there a better way to do two-factor authentication?
There's two main ways to use 2FA. The first is where you enter a code each time you log in, and the second is where you authenticate the login through a mobile app. If you install the Salesforce ...
- 433k
8
votes
Accepted
Salesforce Server-To-Server API authentication
I believe the JWT Bearer OAuth 2.0 flow is the way to go here.
There is some setup involved (you need to generate/use an X509 certificate, use the user-agent or web-server flows to authorize once), ...
- 48.1k
7
votes
Accepted
Is login history only stored for 6 months?
Yes, the logs go back just six months. Even salesforce's Data Recovery option only goes back three months. If you're concerned that you need a longer audit trail, there are ways of doing this.
Two ...
- 433k
7
votes
Accepted
Accessing Named Credentials' data in apex
You can use Named Credentials to create an End point URL with necessary parameters. For example, if this is is your URL:
https://www.someendpointurl.com?param1=named¶m2=credentials
In Apex, ...
- 1,967
7
votes
error=redirect_uri_mismatch&error_description=redirect_uri%20must%20match%20configuration
I had the same problem. I found that callback url in the connected app should be the same as you have in your redirect_uri.
I tested it with a tool called postman, maybe that can help you as well.
- 615
7
votes
Accepted
How is this possible to use the Salesforce CLI after changing my user's password?
Salesforce CLI use an access token to connect to your org. This means that even if you change your password or even your username it will still be connected to your org trough your username. If you ...
- 658
7
votes
Determine whether running user is logged in from within Trusted IP Range (from Apex)
You can accomplish this with Auth.SessionManagement class methods. The code below sets the isTrustedIp variable based on whether or not the running user's IP address is in the trusted ranges (as ...
- 2,774
7
votes
Mavensmate: Getting error client identifier invalid while authentication to salesforce
As Joe mentioned above, Mavensmate suffered from a serious CSRF & CORS vulnerability (conceived by @ralph-callaway; confirmed by myself) where any website could make requests against the localhost ...
- 9,516
7
votes
Accepted
Testing Community "Passwordless Login" using the System.UserManagement Class
I think the sad truth is that there is currently (as at v47.0) no support in Apex for testing those methods or the corresponding TwoFactorMethodsInfo API. I'm asking around for verification, but the ...
- 98.5k
6
votes
Accepted
"Session expired or invalid" problem calling an @RestResource from Apex in Winter '15 preview; UserInfo.getSession returns null for Force.com Sites
Salesforce backed out this across-the-board change and made it a versioned changed. API Version 31 and earlier will continue to return the session ID from UserInfo.getSessionId() when in the Sites ...
- 2,325
6
votes
When does it make sense to add a Connected App to a Managed Package?
Let's say that you have a salesforce application that communicates with an API you've developed.
That API connects to salesforce using the Consumer Secret and Consumer Key of your connected app, and ...
- 516
6
votes
Accepted
How to connect to Salesforce REST API without OAuth? How does Jitterbit do it?
You can use any login call, and you'll be able to use that session ID with REST. This probably isn't clearly documented, but there are similar questions on here (and other forums) that do explain this....
- 433k
6
votes
Accepted
When to use username & password flow to obtain a token
The username-password flow is only intended for development. It is insecure and should never be used for a production application. As this help topic helpfully warns:
This OAuth authentication flow ...
- 433k
6
votes
Accepted
How do I authorize access to a managed application in another org?
I just went through something similar where the final destination varied depending on the customer so a static callback int he code did not work.
What I did on our LMA org to handle this was:
Placed ...
- 53.1k
6
votes
Accepted
Sandbox verification emails
Have a look at the SandboxPostCopy Interface. It should be possible to have Apex run after the Sandbox is created and then modify the specific User records email address fields.
- 98.5k
6
votes
What method to use in a batch apex in order to get authentication token from a remote server?
I just had a similar requirement that I'm filling by using Platform Cache to hold the token and its expiration timestamp. It looks basically like this:
public class WSAuthentication {
public ...
- 5,368
6
votes
Accepted
How does a website that accesses my salesforce metadata/data authorize against my org?
Connected Apps are "global metadata". They don't need to be present in the target org, just in a single, persistent org that you control.
If you maintain that Connected App in your own org, you can ...
- 86.8k
Only top scored, non community-wiki answers of a minimum length are eligible