45
Well... sort of. The only two officially supported methods are by Basic Authentication and OAuth tokens. That site uses a non-standard API design, so it can't directly benefit from using a Named Credential. "But wait," I hear you say, "you didn't say it wasn't possible." And for that, you'd be correct. Here's what we can do to work within this system's ...
27
To those hacking MavensMate's source code to keep it alive: I strongly recommend you migrate to official Salesforce tooling, namely the VS Code extensions for Salesforce.
MavensMate's codebase has not been updated nor has it been audited for security since development ceased in 2017. Since that time, several of its dependencies have received critical ...
21
Packaging the connected app allows administrators who install the app to control which of their users can use the application.
Rather than the coarse ability to block or not block an app (seen in Setup -> Manage Apps -> Connected Apps Oauth Usage), you get the ability to control the security settings for the app in a more finely grained manner (seen in ...
16
The User Agent (UA) and Web Server (WS) flows have two different security purposes. The main difference is that UA is used for untrusted clients, while WS is used for a server application; the WS uses a Client Secret (CS) as an extra authorization parameter to prevent spoofing servers.
The reason for this is that if a server is compromised, everyone using ...
13
It's my understanding that custom authentication schemes invalidate the confidentiality clause of the Salesforce.com Master Subscription Agreement and thus would violate your TOS.
If you are building an app for the AppExchange, you would not pass security review.
13
The SFDX URL can be used to authenticate to the Salesforce CLI without needing any JWT Token or using the browser to key in the credential.
In fact it is the easiest way to authenticate through CLI. Let me explain how salesforce CLI authenticates today.
The first time when you log in via the CLI, you go to the salesforce login screen and key in credentials (...
answered Sep 7 '19 at 15:42
Mohith Shrivastava
84.6k17 gold badges136 silver badges191 bronze badges
12
It's possible using the Mutual authentication feature which allows you to setup certificates for users so they are authenticated via a certificate instead of a username/password. Please note that this is not enabled by default in your org and you need to raise a case to get it.
The steps involved are
Contact salesforce.com to have mutual authentication ...
12
There has been a lot of discussion around speed of development and reusable components and while I do think we get decent marks for that the real promise of lightning components is that for the first time salesforce is opening up access to the presentation layer technology it is using to build customizable applications. The main benefits have not been ...
9
The key to solving this problem lies in two parts:
Having a dedicated SF User to handle all requests from your 3rd Party to SFDC
Creating your own User DB + Code to that verifies your 3rd Party user credentials. Once verified, they will then have access to the SF User. The extra code you'll have to write is to manage what kind of processes you want to ...
9
Support have come back with:
confirmed with R&D that this is not a BUG rather a security update
that is introduced in Winter'15 release
and advise:
affected customers will need to adjust their integration's to not rely
on a guest session ID
9
Your token didn't expire, your password did. As an administrator, you can make a Permission Set with the Password Never Expires permission, and assign it to your user account (affects only yourself), or you can change the Password Policies so that passwords never expire (affects all users in your org). You'll never have to worry about expired passwords again....
9
MavensMate has reached its End Of Life. The connected app that it used to authenticate with Salesforce has been decommissioned, as indicated by the OAuth failure you see.
There is the chance it could be brought back to life if you were to supply a connected app client id to the Node process based on an examination of the core MavensMate package. It accepts ...
8
This discussion forum thread suggests that you can do this with
https://<instance>.salesforce.com/secur/frontdoor.jsp?sid=<sessionId>&orgId=<orgId>&portalId=<portalId>
Change <instance> to the relevant instance, e.g. na1, and substitute in the relevant IDs.
8
Two Factor Authentication is supported for Community Users as pointed out by Rob Cowell.
For standard user license type, you my be accustomed to enabling 2FA via the System Permission Two-Factor Authentication for API Logins and Two-Factor Authentication for User Interface Logins. However, you might not see these options for community profiles.
Per Set Two-...
8
Fill the field 'User Info Endpoint URL' (on Auth provider page ) with this and test it out.
https://graph.facebook.com/me?fields=first_name,last_name,email
Reason for suggestion is:
Facebook api v2.2, 2.3 returns first name, last name, email etc by default.
Facebook api v2.4 and later versions don't return these fields unless we specify /me?fields=...
8
There's two main ways to use 2FA. The first is where you enter a code each time you log in, and the second is where you authenticate the login through a mobile app. If you install the Salesforce Authenticator, and connect it to your login for 2FA, you can then log in simply by pressing a button on your phone after entering your password. Additionally, during ...
8
I believe the JWT Bearer OAuth 2.0 flow is the way to go here.
There is some setup involved (you need to generate/use an X509 certificate, use the user-agent or web-server flows to authorize once), but after you do that the JWT flow can run in a headless environment (such as AWS).
I went into some pretty fine detail in authentication using jwt about how to ...
7
Yes, the logs go back just six months. Even salesforce's Data Recovery option only goes back three months. If you're concerned that you need a longer audit trail, there are ways of doing this.
Two thoughts that come to mind are delegated authentication and regular exports of the login history.
The former works because delegated authentication moves ...
7
Salesforce CLI use an access token to connect to your org. This means that even if you change your password or even your username it will still be connected to your org trough your username. If you want to revoke the access permission you can do it by navigating to Setup>Home>Apps>Connected Apps>Connected Apps OAuth Usage and block the Salesforce CLI app.
7
You can accomplish this with Auth.SessionManagement class methods. The code below sets the isTrustedIp variable based on whether or not the running user's IP address is in the trusted ranges (as defined in Setup > Network Access > Trusted IP Ranges):
Boolean isTrustedIp = false;
Map<String, String> sessionAttributes;
try {
...
7
As Joe mentioned above, Mavensmate suffered from a serious CSRF & CORS vulnerability (conceived by @ralph-callaway; confirmed by myself) where any website could make requests against the localhost server. This essentially meant any website you visited could access the auth tokens for your authenticated orgs.
For Example, the following script will ...
6
You need to:
Set up a Force.com Site
Grant certain object permissions and field level security for each Timba Object to the Site's Guest Profile (Public Access Settings)
Grant access to the TIMBA Apex classes and select Visualforce pages to the Site's Guest Profile (Public Access Settings)
Configure the Timba app to use the site
Take a look at the Timba ...
6
Note that in the current version (Winter 13), the Authentication Service option is now under 'Login Page Branding', and you specify the name of the SAML Setting you configured. See screenshot.
6
When you use OAuth2 in a web browsing context, two things happen: (1) the user has to log in to salesforce.com and receive a "sid" (session ID), then (2) the user has to authorize the app if it is not already authorized. What this means is that the user is logged in twice, once with a session ID, and once with a access token.
As long as any browser process ...
6
Salesforce backed out this across-the-board change and made it a versioned changed. API Version 31 and earlier will continue to return the session ID from UserInfo.getSessionId() when in the Sites guest user context. Your VF Page and Apex Controller must be Version 31 or earlier.
The patch hit the Winter '15 sandboxes last night (Sept 30) and will hit the ...
6
Let's say that you have a salesforce application that communicates with an API you've developed.
That API connects to salesforce using the Consumer Secret and Consumer Key of your connected app, and it is used to grant access to the org using OAuth.
Now you package that app and start distributing it through the appexchange.
Every time somebody installs your ...
6
You can use any login call, and you'll be able to use that session ID with REST. This probably isn't clearly documented, but there are similar questions on here (and other forums) that do explain this.
For example, I use this code to get my browser session:
document.cookie.match(/sid=(.+?);/)[1]
...which I can then throw directly into the Authorization ...
6
You can use Named Credentials to create an End point URL with necessary parameters. For example, if this is is your URL:
https://www.someendpointurl.com?param1=named¶m2=credentials
In Apex, You can access this URL like this:
request.setEndpoint('callout:EndPointURL');
Where, EndPointURL is the Name of the Named Credentials.
Benefits of using ...
6
The username-password flow is only intended for development. It is insecure and should never be used for a production application. As this help topic helpfully warns:
This OAuth authentication flow involves passing the user’s credentials back and forth. Use this authentication flow only when necessary. No refresh token will be issued.
Note that you do ...
6
I just went through something similar where the final destination varied depending on the customer so a static callback int he code did not work.
What I did on our LMA org to handle this was:
Placed the connected app within the LMA org
Added a VF page and code to handle the callback on a force.com site
Added the URL of the callback on the connected app for ...
Only top voted, non community-wiki answers of a minimum length are eligible