39
In the JWT Bearer OAuth flow, the connected app is identified by the connected app's consumer key (provided in the "iss" parameter of the JWT claims). Pre-authorizing users has very little to do with it (Profiles will need to be pre-authorized with the connected app, or users will need to approve the connected app through some other OAuth flow before you can ...
27
I see you've discovered most of this for yourself, but I had this drafted, so I thought I'd post it also, in case it fills in any gaps.
From the docs on connected apps:
An application may be listed more than once. Each time you grant
access to an application, it obtains a new access token. Requests for
refresh tokens increase the Use Count displayed ...
24
One organization acts as the "host" of the connected app. All other orgs will automatically "install" it on the first use in that org. There's no need to package it up or deploy it anywhere. If you were to create it in every other org, you'd have unique client ID and client secret values, which would be disastrous at best. I would say you should create your ...
21
Packaging the connected app allows administrators who install the app to control which of their users can use the application.
Rather than the coarse ability to block or not block an app (seen in Setup -> Manage Apps -> Connected Apps Oauth Usage), you get the ability to control the security settings for the app in a more finely grained manner (seen in ...
20
Just navigate Name > Setup > Create > apps and then click on the app you need. The page you load will contain those information under API (Enable OAuth Settings).
18
https://help.salesforce.com/apex/HTViewHelpDoc?id=remoteaccess_request_manage.htm
An application may be listed more than once. Each time you grant access to an application, it obtains a new access token. Requests for refresh tokens increase the Use Count displayed for the application. You must grant access to your Salesforce data from each device that you ...
17
Update: As of version 32 you can now supply your own ConsumerKey and ConsumerSecret when creating a Connected App.
You can use the Salesforce Metadata API to create a Connected App, it provides the ConnectedApp metadata type for this purpose. You can either use the File Based method or the CRUD method (preferable for programatic creation).
Represents a ...
15
http://www.salesforce.com/us/developer/docs/platform_connect/Content/quick_start_config_who_can_access_canvas_app.htm
In your connected application you will see related list where you can configure both profiles and permission sets allowed to pre-authorize your connected application
answered Sep 17 '14 at 3:50
Mohith Shrivastava
84.5k17 gold badges136 silver badges190 bronze badges
14
In the Enterprise edition I am using, to find the client id and secret for an existing app, I had to go to Setup > App Manager > Down Arrow next to app name > View > look under 'API (Enable OAuth Settings)'.
This was very confusing as you'd think you could go to Setup > Connected Apps > then click on the App name to see it... but nope, it wasn't there. ...
14
You should be able to delete the Connected App by going into the app itself:
Setup -> Create -> Apps -> Click on the Connected App -> Delete
12
This is a long answer that attempts to explain exactly what's going on here, and how HTML5 and the Force.com Canvas SDK allow safe cross-origin access. It may be that your issue has no solution, but at least you'll understand why!
The same-origin policy restricts how a document or script loaded from one origin can interact with a resource from another ...
11
Easy cookie :)
you are looking under Manage Apps. The doc says look for Apps, if you search in the quick find you should see Apps under the create menu
Go to setup --> Create --> Apps --> Connected Apps
you can create new connected app from here :)
10
Are you copying your authorization code from browser redirect? Its getting URL encoded and hence its saying invalid authorization code.
Check if your auth code is ending with "%3D%3D" replace that with "==" .
This solved my problem plenty of times.
9
Yes, administrators can "pre-authorize" an app. Go to the connected app settings (Settings > Manage Apps > Connected Apps), and under the OAuth Policies section, choose "Admin approved users are pre-authorized" under "Permitted Users". Afterwards, you'll need to edit each profile and check the permission in the Connected App Access section. You can also use ...
9
The problem was the certificate uploaded in the Digital Certificate/Digital Signature field of the connected app. After uploading the proper certificate, the access token is returned.
9
This might not be what you're looking for, but I felt like I should float the idea out there anyways.
One good restrictive OAuth Scope is: Provide access to custom applications (visualforce). With this scope, all regular api calls will fail, and you can restrict access to just the few visualforce pages that you want that user/profile to have access to. ...
8
I would think so - each Connected App gets a unique set of credentiuals.
But as I understand it, you don't need to package the Connected App to make it available for the package to actually use. So I am wondering it might make more sense to just designate one org as the Connected App org for that package, and use those credentials throughout, rather than ...
8
No, setting up an identity provider isn't necessary to use an oauth connected app. Just create your connected app and use the supplied client id/secret to handle the login.
8
In short, yes, you're on a fool's errand.
The general rule is that you can't package any settings that would allow granting 'system' permissions. That is, permissions that affect more than just the objects/schema that your package contains.
For example, you can't package CRUD/FLS on Standard Objects and you can't grant System Permissions like ModifyAllData ...
8
The Namespace Registry Connected App is the Connected App under which your Dev Hub authorizes to your packaging org. Completing this linkage allows your Dev Hub to spin up namespaced scratch orgs using the namespace owned by the packaging org. If you don't use namespaced scratch orgs, you don't need to connect the namespace registry.
You shouldn't try to ...
7
As a developer, you only need to create the connected app once, in a Developer Edition. You publish your app, and it's good to go. You do not need to create a connected app configuration in any other org. Users from other orgs can log in via your app, without there being a corresponding connected app in their own org.
7
See Signed Request Authentication.
Has:
a change been made to the Permitted Users field from "Admin approved users are pre-authorized" to "All users may self-authorize", or
when using "All users may self-authorize" and the access token was revoked by the administrator or a time limit was set on the token.
From the docs under Permitted User Value "All ...
7
A connected app is much like an "app" on Facebook. The actual app exists elsewhere, but authenticates with Facebook to retrieve database information (e.g. your friends, date of birth, and email).
Simply direct the user to the authentication service (such as https://login.salesforce.com/services/oauth2/authorize) with your connected app details, and the user ...
7
Embedding a Lightning .app is totally possible using any iframe based approach including Canvas. This is embedding a single page app though which is a very course grained approach which might be fine if the interaction is also course grained. We're actively working on Lightning Out to allow you to directly embed lightning components cross domain - they run ...
7
This is a feature of OAuth, and is working as designed. A connected app clientId and secret can be used to connect to any org provided you go through oauth flow and enter username and password (or alternatively provide them using the username-password flow).
Note that you will still need username and password for the PROD and cannot access anything allowed ...
answered Apr 3 '18 at 21:08
Mohith Shrivastava
84.5k17 gold badges136 silver badges190 bronze badges
7
Problem is with domain name used in url. :|
Using the domain as in "Setup > My Domain" fixed the issue.
I have used : https://testOrg.lightning.force.com/ (Did not work)
Supposed to be: https://testOrg.my.salesforce.com/ (Worked)
Thanks.
7
Unfortunately, no. The endpoint you're using seems exactly what you want/need - but, as you noted, will only give you custom notifications.
You can see this older question that mentions the lack of ability to get Chatter notifications in API/Apex. You can also see the following idea that was created and archived for low activity.
A workaround would involve a ...
6
Possible Flaw in Metadata API and Source Control. I think you may have found a flaw in the development cycle your using and the Metadata API when it comes to Connected Apps. You quite rightly want all your components in source control, yet clearly some attributes of those components cannot be captured and reapplied.
The Need to Package Connected Apps. Yet ...
6
Let's say that you have a salesforce application that communicates with an API you've developed.
That API connects to salesforce using the Consumer Secret and Consumer Key of your connected app, and it is used to grant access to the org using OAuth.
Now you package that app and start distributing it through the appexchange.
Every time somebody installs your ...
6
Packaging a Connected App is a legacy feature that was initially required in order to use them in other orgs. This is no longer a requirement, as the first time it is used in an org, it's automatically "installed" so that administrators can configure it. You don't even need a managed package at all any more for this purpose, as the Client ID that you provide ...
Only top voted, non community-wiki answers of a minimum length are eligible