43
votes
Accepted
Authentication using JWT
In the JWT Bearer OAuth flow, the connected app is identified by the connected app's consumer key (provided in the "iss" parameter of the JWT claims). Pre-authorizing users has very little ...
- 63.3k
19
votes
Where do I find the client id and client secret of an existing connected app?
In the Enterprise edition I am using, to find the client id and secret for an existing app, I had to go to Setup > App Manager > Down Arrow next to app name > View > look under 'API (Enable OAuth ...
- 291
12
votes
Accepted
OAuth 2.0 access token request failed with error "must use HTTP POST"
Problem is with domain name used in url. :|
Using the domain as in "Setup > My Domain" fixed the issue.
I have used : https://testOrg.lightning.force.com/ (Did not work)
Supposed to be: ...
- 701
11
votes
Accepted
Authentication Failure when submitting Authorization Code in OAuth Web-Server Flow
Are you copying your authorization code from browser redirect? Its getting URL encoded and hence its saying invalid authorization code.
Check if your auth code is ending with "%3D%3D" replace that ...
- 36.3k
11
votes
error=redirect_uri_mismatch&error_description=redirect_uri%20must%20match%20configuration
I had the same problem. I found that callback url in the connected app should be the same as you have in your redirect_uri.
I tested it with a tool called postman, maybe that can help you as well.
- 675
9
votes
OAuth2 JWT Bearer token flow - "error": "invalid_client", "error_description": "invalid client credentials"
The problem was the certificate uploaded in the Digital Certificate/Digital Signature field of the connected app. After uploading the proper certificate, the access token is returned.
- 412
9
votes
Accepted
How to further limit OAuth API scope access
This might not be what you're looking for, but I felt like I should float the idea out there anyways.
One good restrictive OAuth Scope is: Provide access to custom applications (visualforce). With ...
- 12.7k
9
votes
Accepted
Error authenticating with JWT config due to: audience is invalid
I'm not set up to test the scenario you've laid out precisely, but I was able to repoduce the error using what I imagine is equivalent code in the developer console. Looks like the -r/--instanceurl ...
- 63.3k
8
votes
Accepted
How Do You Enable SAML IdP in a Partner Community?
The process is very much similar to how you set up for Internal Users except that you need to replace with Community URLS .
Lets look at step by step the mechanism to accomplish the same .For ...
- 91.7k
8
votes
Accepted
Connected App built in SANDBOX has access to PROD
This is a feature of OAuth, and is working as designed. A connected app clientId and secret can be used to connect to any org provided you go through oauth flow and enter username and password (or ...
- 91.7k
8
votes
Accepted
Is it possible to programmatically change connectedApp settings in production?
In short, yes, you're on a fool's errand.
The general rule is that you can't package any settings that would allow granting 'system' permissions. That is, permissions that affect more than just the ...
- 2,683
8
votes
Accepted
What's the purpose of the SalesforceDX Namespace Registry Connected App?
The Namespace Registry Connected App is the Connected App under which your Dev Hub authorizes to your packaging org. Completing this linkage allows your Dev Hub to spin up namespaced scratch orgs ...
- 93.4k
8
votes
Accepted
Do expired certificates for salesforce connected applications block connections?
As you have discovered, in the Salesforce world the alternative to client credentials grant for service-to-service calls is JWT Bearer. It is standardized (RFC 7523), Salesforce was one of the RFC ...
- 7,747
8
votes
Accepted
Retrieve standard and custom notifications of a user in Apex
Unfortunately, no. The endpoint you're using seems exactly what you want/need - but, as you noted, will only give you custom notifications.
You can see this older question that mentions the lack of ...
- 22.5k
7
votes
Accepted
Package Connected App
Packaging a Connected App is a legacy feature that was initially required in order to use them in other orgs. This is no longer a requirement, as the first time it is used in an org, it's ...
- 500k
7
votes
Accepted
How do I authorize access to a managed application in another org?
I just went through something similar where the final destination varied depending on the customer so a static callback int he code did not work.
What I did on our LMA org to handle this was:
Placed ...
- 54.3k
7
votes
When and where should a connected app be created during DX managed package development?
I found the following in the Special Behavior in Metadata API Deployments:
Connected App
You cannot set the consumerKey in Metadata API. It is included in a retrieve operation for informational ...
- 103k
7
votes
Accepted
2GP Source Push Error: The consumer key is already taken
The best practice is to package up your connected app along with the other components in 2GP.
Now the way you package up the Connected App in 2GP is different, I will go down the steps here,
Create a ...
- 91.7k
7
votes
Packaging Connected App in 2gp package - CLI says package is deleted?
You don't actually need to package the Connected App, especially when all/many of your clients use the same connected app with the same secret/ID and same mobile app (for example). The important thing ...
- 37.6k
6
votes
What's the practical difference between canvas & connected apps?
I want to explain this in a different way. Some of the difference between the two is lying within the settings for canvas app as below. As soon as you click that little checkbox called 'Canvas' within ...
6
votes
Accepted
How to get Connected App details in Apex?
The Client Secret is a password, and should be treated as such. You can read more about this feature in the ConnectedApp documentation:
A value that is combined with the consumerKey and used by the ...
- 500k
6
votes
Setting Up JWT oAuth Flow
just as an FYI: you could have avoided the manual login if you had set the policy settings to:
Permitted Users: Admin approved users are pre-authorized
and then assigned the Connected App to the ...
- 71
6
votes
Accepted
UserInfo.getSessionID() or connected app with consumer key and secret for a rest resource within a same org
UserInfo.getSessionId() now works in asynchronous code as of Winter '19. The sandbox that it's currently failing in is most likely in Summer '18. Once your sandbox is upgraded, it should work as ...
- 500k
6
votes
Metadata API Apex fails to create fields in Connected App
I think the second problem you listed is causing the first problem, and unfortunately it's a bit of a layered answer. I'm also assuming that the MetadataService layer you've generated is all correct.
...
- 1,121
6
votes
Accepted
How to know what certificate is associated with a connected app?
You can see the certificate's subject in the admin UI on the connected app details page (Setup > Build > Apps > Create ... find your app and click on the app name). The Digital Certificate ...
- 7,747
6
votes
Accepted
How does a website that accesses my salesforce metadata/data authorize against my org?
Connected Apps are "global metadata". They don't need to be present in the target org, just in a single, persistent org that you control.
If you maintain that Connected App in your own org, you can ...
- 93.4k
5
votes
Accepted
OAuth username password through Apex for Community Users
From the official documentation
Communities support all available authentication flows, except for the username-password OAuth authentication flow and the SAML assertion flow.
Hence what you are ...
- 91.7k
5
votes
Can I connect to a sandbox using JWT Flow and Prod connect app?
You can use the Connected App from your production org, but to avoid the user hasn't approved this consumer error, I've found that you need to authenticate using the password and the Connected App's ...
- 2,488
5
votes
How much time Salesforce takes to Review a lightning app before uploading that on AppExchange?
The security scan of the code is pretty quickly. From my past experience, the results are sent out within 1 hour of submitting for review.
Creating the false positive document and also fixing any ...
- 12.4k
5
votes
Can a Login Flow know which Connected App started it?
You may be in luck. There's something call the ExperienceID or expid that potentially could be used to do what you want to achieve. Its primary purpose is to be able to customize the "branding ...
- 41k
Only top scored, non community-wiki answers of a minimum length are eligible