114
Canvas App
Canvas apps are designed to the part of the user interface. Either the app is designed to appear to be native to salesforce.com, like a Visualforce page, or is intended to be accessed through salesforce.com, such as legacy cloud apps. Authentication for a canvas app is server-initiated and controlled by profiles and permission settings. The app ...
36
In the JWT Bearer OAuth flow, the connected app is identified by the connected app's consumer key (provided in the "iss" parameter of the JWT claims). Pre-authorizing users has very little to do with it (Profiles will need to be pre-authorized with the connected app, or users will need to approve the connected app through some other OAuth flow before you can ...
26
I see you've discovered most of this for yourself, but I had this drafted, so I thought I'd post it also, in case it fills in any gaps.
From the docs on connected apps:
An application may be listed more than once. Each time you grant
access to an application, it obtains a new access token. Requests for
refresh tokens increase the Use Count displayed ...
21
Packaging the connected app allows administrators who install the app to control which of their users can use the application.
Rather than the coarse ability to block or not block an app (seen in Setup -> Manage Apps -> Connected Apps Oauth Usage), you get the ability to control the security settings for the app in a more finely grained manner (seen in ...
21
One organization acts as the "host" of the connected app. All other orgs will automatically "install" it on the first use in that org. There's no need to package it up or deploy it anywhere. If you were to create it in every other org, you'd have unique client ID and client secret values, which would be disastrous at best. I would say you should create your ...
19
Just navigate Name > Setup > Create > apps and then click on the app you need. The page you load will contain those information under API (Enable OAuth Settings).
17
Update: As of version 32 you can now supply your own ConsumerKey and ConsumerSecret when creating a Connected App.
You can use the Salesforce Metadata API to create a Connected App, it provides the ConnectedApp metadata type for this purpose. You can either use the File Based method or the CRUD method (preferable for programatic creation).
Represents a ...
17
https://help.salesforce.com/apex/HTViewHelpDoc?id=remoteaccess_request_manage.htm
An application may be listed more than once. Each time you grant access to an application, it obtains a new access token. Requests for refresh tokens increase the Use Count displayed for the application. You must grant access to your Salesforce data from each device that you ...
15
In every case, as the app developer, you create a Connected App, obtaining a consumer key and secret for that app. Now users can use your app in any org. That's right - you don't need to create a Connected App (and obtain the key and secret) in each 'target' org - you're good to go.
So, Ryan Brainard, the Workbench author, created a Connected App for ...
15
http://www.salesforce.com/us/developer/docs/platform_connect/Content/quick_start_config_who_can_access_canvas_app.htm
In your connected application you will see related list where you can configure both profiles and permission sets allowed to pre-authorize your connected application
answered Sep 17 '14 at 3:50
Mohith Shrivastava
79.7k17 gold badges128 silver badges179 bronze badges
13
You should be able to delete the Connected App by going into the app itself:
Setup -> Create -> Apps -> Click on the Connected App -> Delete
12
Parameters are passed as part of the JSON context structure your Canvas app decodes. See Chapter 6 of the docs, you'll see a parameters example embedded in the context example shown.
Your JSON parameters appear to be correct and as per the documentation you linked to. I've just tried it with one of my CanvasApps and my app does successfully render.
<...
12
This is a long answer that attempts to explain exactly what's going on here, and how HTML5 and the Force.com Canvas SDK allow safe cross-origin access. It may be that your issue has no solution, but at least you'll understand why!
The same-origin policy restricts how a document or script loaded from one origin can interact with a resource from another ...
10
In the Enterprise edition I am using, to find the client id and secret for an existing app, I had to go to Setup > App Manager > Down Arrow next to app name > View > look under 'API (Enable OAuth Settings)'.
This was very confusing as you'd think you could go to Setup > Connected Apps > then click on the App name to see it... but nope, it wasn't there. ...
10
Easy cookie :)
you are looking under Manage Apps. The doc says look for Apps, if you search in the quick find you should see Apps under the create menu
Go to setup --> Create --> Apps --> Connected Apps
you can create new connected app from here :)
10
Are you copying your authorization code from browser redirect? Its getting URL encoded and hence its saying invalid authorization code.
Check if your auth code is ending with "%3D%3D" replace that with "==" .
This solved my problem plenty of times.
9
It appears there is something special about the meta data for a Connected App.
I have one in my Dev org, but I can't add it to an unmanaged package.
However, in a managed package the "Connected App" Component Type appears.
Based on the managed package component type select options I'd expect the Metadata component to be "ConnectedApplication2".
As you ...
9
Yes, administrators can "pre-authorize" an app. Go to the connected app settings (Settings > Manage Apps > Connected Apps), and under the OAuth Policies section, choose "Admin approved users are pre-authorized" under "Permitted Users". Afterwards, you'll need to edit each profile and check the permission in the Connected App Access section. You can also use ...
9
This might not be what you're looking for, but I felt like I should float the idea out there anyways.
One good restrictive OAuth Scope is: Provide access to custom applications (visualforce). With this scope, all regular api calls will fail, and you can restrict access to just the few visualforce pages that you want that user/profile to have access to. ...
8
Practically, canvas apps are accessible inside salesforce and can be build using any language of your choice. By this, I mean we can interact with salesforce from a external application, but within salesfore and with an interactive UI. Canvas don't work in offline mode as they have an UI, but connected apps can access data from salesforce even if user is ...
8
I would think so - each Connected App gets a unique set of credentiuals.
But as I understand it, you don't need to package the Connected App to make it available for the package to actually use. So I am wondering it might make more sense to just designate one org as the Connected App org for that package, and use those credentials throughout, rather than ...
8
No, setting up an identity provider isn't necessary to use an oauth connected app. Just create your connected app and use the supplied client id/secret to handle the login.
8
In short, yes, you're on a fool's errand.
The general rule is that you can't package any settings that would allow granting 'system' permissions. That is, permissions that affect more than just the objects/schema that your package contains.
For example, you can't package CRUD/FLS on Standard Objects and you can't grant System Permissions like ModifyAllData ...
7
As a developer, you only need to create the connected app once, in a Developer Edition. You publish your app, and it's good to go. You do not need to create a connected app configuration in any other org. Users from other orgs can log in via your app, without there being a corresponding connected app in their own org.
7
See Signed Request Authentication.
Has:
a change been made to the Permitted Users field from "Admin approved users are pre-authorized" to "All users may self-authorize", or
when using "All users may self-authorize" and the access token was revoked by the administrator or a time limit was set on the token.
From the docs under Permitted User Value "All ...
7
Embedding a Lightning .app is totally possible using any iframe based approach including Canvas. This is embedding a single page app though which is a very course grained approach which might be fine if the interaction is also course grained. We're actively working on Lightning Out to allow you to directly embed lightning components cross domain - they run ...
7
The problem was the certificate uploaded in the Digital Certificate/Digital Signature field of the connected app. After uploading the proper certificate, the access token is returned.
7
The Namespace Registry Connected App is the Connected App under which your Dev Hub authorizes to your packaging org. Completing this linkage allows your Dev Hub to spin up namespaced scratch orgs using the namespace owned by the packaging org. If you don't use namespaced scratch orgs, you don't need to connect the namespace registry.
You shouldn't try to ...
6
If the org has white listing turned on (e.g. only these approved apps can connect) then anything else won't be allowed to login. Is there a reason why you're not doing an oauth flow to authenticate your app, especially as you've defined a connected app for it.
Also, if you want to authenticate without using a users API security token, you'll need to do it ...
6
Possible Flaw in Metadata API and Source Control. I think you may have found a flaw in the development cycle your using and the Metadata API when it comes to Connected Apps. You quite rightly want all your components in source control, yet clearly some attributes of those components cannot be captured and reapplied.
The Need to Package Connected Apps. Yet ...
Only top voted, non community-wiki answers of a minimum length are eligible
