Hot answers tagged

28 votes
Accepted

Connected App - avoiding a limit on a number of issued tokens + token expiration

I see you've discovered most of this for yourself, but I had this drafted, so I thought I'd post it also, in case it fills in any gaps. From the docs on connected apps: An application may be ...
user avatar
  • 16.2k
21 votes
Accepted

When does it make sense to add a Connected App to a Managed Package?

Packaging the connected app allows administrators who install the app to control which of their users can use the application. Rather than the coarse ability to block or not block an app (seen in ...
user avatar
  • 2,499
18 votes

Connected App - avoiding a limit on a number of issued tokens + token expiration

https://help.salesforce.com/apex/HTViewHelpDoc?id=remoteaccess_request_manage.htm An application may be listed more than once. Each time you grant access to an application, it obtains a new access ...
user avatar
  • 1,325
17 votes
Accepted

Pros and cons of user-agent flow vs web server flow

The User Agent (UA) and Web Server (WS) flows have two different security purposes. The main difference is that UA is used for untrusted clients, while WS is used for a server application; the WS uses ...
user avatar
  • 433k
15 votes

Salesforce: Any API for getting user information?

There is an actual endpoint for this now as well: https://login.salesforce.com/services/oauth2/userinfo See here for the help document
user avatar
  • 251
12 votes
Accepted

OAuth interactions: do they count as API calls?

After hammering the login.salesforce.com endpoints today (and getting blocked a couple of times), I've established (at least to my satisfaction) that the OAuth interactions around granting access ...
user avatar
  • 13.3k
11 votes
Accepted

Authentication Failure when submitting Authorization Code in OAuth Web-Server Flow

Are you copying your authorization code from browser redirect? Its getting URL encoded and hence its saying invalid authorization code. Check if your auth code is ending with "%3D%3D" replace that ...
user avatar
9 votes
Accepted

oAuth - Introspection endpoint says a valid access token is inactive

The response of {"active": false} is only allowed in very specific context. From oAuth Introspection spec (RFC 7662): If the introspection call is properly authorized but the token is not active, ...
user avatar
  • 6,226
8 votes

Missing SOAP action header

Looking at the Partner WSDL, the soapAction for the login operation is the empty string. <operation name="login"> <soap:operation soapAction=""/> <!-- .... --> ...
user avatar
8 votes
Accepted

Username-Password OAuth Authentication for community users?

In the profile of the user make it as API enabled. I was able to log in using api inside the community using the below soap login call., <Envelope xmlns="http://schemas.xmlsoap.org/soap/envelope/"...
user avatar
7 votes
Accepted

Canvas App started sending GET instead of POST

See Signed Request Authentication. Has: a change been made to the Permitted Users field from "Admin approved users are pre-authorized" to "All users may self-authorize", or when using "All users ...
user avatar
7 votes

how to access a connected app from another org

A connected app is much like an "app" on Facebook. The actual app exists elsewhere, but authenticates with Facebook to retrieve database information (e.g. your friends, date of birth, and email). ...
user avatar
  • 433k
7 votes
Accepted

List of All OAuth Errors?

Salesforce responds to OAuth errors with Standard OAuth 2.0 error codes which can be found in the final version of the OAuth 2.0 spec: RFC 6749. In addition to the required error attribute, Salesforce ...
user avatar
  • 22.3k
7 votes
Accepted

Security Review Oauth Callback "Insecure Storage of Sensitive Data"

My solution for determining the users email address is going to be to make a SOQL query to the sObject 'User' immediately after the OAuth flow completes. Is there something similar I can do for ...
user avatar
6 votes

When does it make sense to add a Connected App to a Managed Package?

Let's say that you have a salesforce application that communicates with an API you've developed. That API connects to salesforce using the Consumer Secret and Consumer Key of your connected app, and ...
user avatar
6 votes
Accepted

Salesforce OAuth Token IP Restrictions

The most likely cause is that you have 'Lock sessions to the IP address from which they originated' enabled in 'Session Settings' - uncheck that if it is checked and give it a try.
user avatar
  • 16.2k
6 votes
Accepted

OAuth Authorization Flow for AppExchange Packages

Yes From the doc: AppExchange Partners: Request Tokens on Your Customer’s Behalf Multitenant AppExchange partners that use web app integrations with Marketing Cloud must be prepared to ...
user avatar
  • 6,226
5 votes
Accepted

Server to Server JWT Authentication Certificate management

The JWT Authentication Flow can be initiaded using the usual OAuth2 Authorization Flow. Setup: Setup the App, get the required client_key and client_secret Build > Create > Apps Create a new Keypair ...
user avatar
  • 161
5 votes
Accepted

Difference between Authentication and Identity Provider

Short answer is yes. Salesforce can be Authentication Provider and Identity Provider at same time. The main difference between Authentication Provider and Identity provider is - Identity Provider :...
user avatar
5 votes
Accepted

OAuth implementation in SOAP API (C#)

I recently had some challenges adding a SOAP Header when creating a Universal Windows Platform (UWP) application in .NET against the SOAP based APIs. The problem was that the WCF tooling for ...
user avatar
5 votes

Cannot connect a Salesforce org using Authorize an org in VS Code

There's a different login flow that's intended for other devices where this local webserver setup isn't feasible, but it's actually a great way of dealing with this exact issue on desktops too! You ...
user avatar
  • 24.7k
5 votes

oAuth - Introspection endpoint says a valid access token is inactive

Haven't found any documentation to support this, so it's just speculation, but based on the lack of any mention of an "active" parameter (outside of child sessions) in the documentation on ...
user avatar
  • 48.1k
4 votes

OAuth 2.0 JWT Bearer Token Flow giving a user hasn't approved this consumer error

Based from the salesforce documentation: The authorization server validates the JWT and issues an access_token based upon prior approval of the application. It means you have to authorize the ...
user avatar
4 votes

REST OAuth connection for Bulk API queries

The Session ID that you get from any login source (SOAP or REST API) is generally compatible with any API that accepts such a Session ID (SOAP, REST, Metadata, Bulk, Streaming, etc). However, that ...
user avatar
  • 433k
4 votes
Accepted

OAuth callback through HTTP (not SSL) is possible?

No - the only callback you can use with plain HTTP is localhost. This is to ensure the security of the tokens.
user avatar
  • 16.2k
4 votes
Accepted

Safest way to see if a user is still "logged in" (REST API)

You could request one of the more basic REST resources, such as Versions or Limits. If they have API access then there will always be a resource for a valid Session.
user avatar
4 votes

Why Salesforce oAuth Username Password flow does not need a security token?

You are completely mistaken on this one. A Connected App offers several parameters from a security perspective and it's not just about client id and client secret. Each connected app has its own oAuth ...
user avatar
4 votes
Accepted

JWT Oauth flow Confusion

JWT doesn't sound like the correct solution to your problem but to expand on Keith's answer a bit: The JWT OAuth flow is predicated on a previously set up mutual trust between you (the app developer) ...
user avatar
  • 22.3k
4 votes
Accepted

Canvas Signed Request vs OAuth flow

Signed request is completely secure while oauth flow is provided in case you want to do two way oauth and also alert the user that he is allowing access to the resources . When you do an oauth flow ,...
user avatar
4 votes

(400) - Bad Request when requesting auth token using Wordpress

So I got it working. I had to change the Content-Type header to application/x-www-form-urlencoded, which I tried because of this answer. Unfortunately the docs don't tell you that. In fact they say ...
user avatar
  • 71

Only top scored, non community-wiki answers of a minimum length are eligible