Hot answers tagged

26

I see you've discovered most of this for yourself, but I had this drafted, so I thought I'd post it also, in case it fills in any gaps. From the docs on connected apps: An application may be listed more than once. Each time you grant access to an application, it obtains a new access token. Requests for refresh tokens increase the Use Count displayed ...


21

Packaging the connected app allows administrators who install the app to control which of their users can use the application. Rather than the coarse ability to block or not block an app (seen in Setup -> Manage Apps -> Connected Apps Oauth Usage), you get the ability to control the security settings for the app in a more finely grained manner (seen in ...


17

https://help.salesforce.com/apex/HTViewHelpDoc?id=remoteaccess_request_manage.htm An application may be listed more than once. Each time you grant access to an application, it obtains a new access token. Requests for refresh tokens increase the Use Count displayed for the application. You must grant access to your Salesforce data from each device that you ...


15

The User Agent (UA) and Web Server (WS) flows have two different security purposes. The main difference is that UA is used for untrusted clients, while WS is used for a server application; the WS uses a Client Secret (CS) as an extra authorization parameter to prevent spoofing servers. The reason for this is that if a server is compromised, everyone using ...


14

There is an actual endpoint for this now as well: https://login.salesforce.com/services/oauth2/userinfo See here for the help document


12

After hammering the login.salesforce.com endpoints today (and getting blocked a couple of times), I've established (at least to my satisfaction) that the OAuth interactions around granting access tokens and refreshing them do not count against the API limits. More specifically, I've hit the following endpoints 1,000 times each today. https://login....


10

Are you copying your authorization code from browser redirect? Its getting URL encoded and hence its saying invalid authorization code. Check if your auth code is ending with "%3D%3D" replace that with "==" . This solved my problem plenty of times.


9

First you need to create a remote Application . Setup -->Create --> App-->Connected Apps-->Fill The Necessary Details --> mention CallBackURL as https://ap1.salesforce.com/services/oauth2/token ,Callback URL in salesforce is nothing but what Salesforce will callback with once the user authorizes access to his/her Salesforce account. Provide callback url as ...


9

We can do this with Apps and Profiles in Salesforce. Associate the custom Landing page(VF Page) to a Visualforce Tab (Create --> Tab --> New VF Tab) Create an App and associate required Tabs to newly created App. (Create --> Apps) Set the Default Landing page in the App settings. Now go to Profiles (Manage User --> Profiles --> Custom App Settings) Set the ...


7

If its a non Web Java desktop application, will it be used as a background process or will always have user access. a. If its a background process, then you should simply store the credentials in property file may be encrypted and decrypt it before you hit the salesforce apis.. b. If its a user access process, then leverage swing based JDialogbox to ask ...


7

See Signed Request Authentication. Has: a change been made to the Permitted Users field from "Admin approved users are pre-authorized" to "All users may self-authorize", or when using "All users may self-authorize" and the access token was revoked by the administrator or a time limit was set on the token. From the docs under Permitted User Value "All ...


7

A connected app is much like an "app" on Facebook. The actual app exists elsewhere, but authenticates with Facebook to retrieve database information (e.g. your friends, date of birth, and email). Simply direct the user to the authentication service (such as https://login.salesforce.com/services/oauth2/authorize) with your connected app details, and the user ...


7

Salesforce responds to OAuth errors with Standard OAuth 2.0 error codes which can be found in the final version of the OAuth 2.0 spec: RFC 6749. In addition to the required error attribute, Salesforce will also generally provide the optional error_description attribute. From the spec doc: error: A single ASCII [USASCII] error code from the following: ...


7

My solution for determining the users email address is going to be to make a SOQL query to the sObject 'User' immediately after the OAuth flow completes. Is there something similar I can do for namespace prefix? Yes, since Spring `16 you can query Organization.NamespacePrefix in SOQL. SELECT NamespacePrefix FROM Organization It's a bit more work, but you ...


7

In the profile of the user make it as API enabled. I was able to log in using api inside the community using the below soap login call., <Envelope xmlns="http://schemas.xmlsoap.org/soap/envelope/"> <Body> <login xmlns="urn:tooling.soap.sforce.com"> <username>tomxxx@dsssd.com</username> <password>...


6

You must use OAth login flow first to have REST access. There is a lot of good information out there about Salesforce OAuth login flow. In order to make it programatically (Server to Server ), I think that the most efficient way is: Steps Set the current access_token to the request header you need to do. Make the request trying to catch any exception. ...


6

Looking at the Partner WSDL, the soapAction for the login operation is the empty string. <operation name="login"> <soap:operation soapAction=""/> <!-- .... --> </operation> So you would think that it should be added to the request as such: HttpRequest req = new HttpRequest(); // ... req.setHeader('SOAPAction'...


6

The most likely cause is that you have 'Lock sessions to the IP address from which they originated' enabled in 'Session Settings' - uncheck that if it is checked and give it a try.


6

Let's say that you have a salesforce application that communicates with an API you've developed. That API connects to salesforce using the Consumer Secret and Consumer Key of your connected app, and it is used to grant access to the org using OAuth. Now you package that app and start distributing it through the appexchange. Every time somebody installs your ...


6

Yes From the doc: AppExchange Partners: Request Tokens on Your Customer’s Behalf Multitenant AppExchange partners that use web app integrations with Marketing Cloud must be prepared to construct their customers’ v2/token endpoint if your application's status is 'Published'. Your application receives the customer’s Marketing Cloud subdomain, or ...


5

The JWT Authentication Flow can be initiaded using the usual OAuth2 Authorization Flow. Setup: Setup the App, get the required client_key and client_secret Build > Create > Apps Create a new Keypair using the Salesforce page Administer > Security Controls > Certificate and Key Management. Both the public and private key can (and should) be saved. Attach ...


5

Short answer is yes. Salesforce can be Authentication Provider and Identity Provider at same time. The main difference between Authentication Provider and Identity provider is - Identity Provider : An identity provider is a trusted provider that lets you use single sign-on to access other websites. A service provider is a website that hosts applications. ...


5

I recently had some challenges adding a SOAP Header when creating a Universal Windows Platform (UWP) application in .NET against the SOAP based APIs. The problem was that the WCF tooling for importing WSDLs in UWP apps doesn't automatically generate the SOAP Header classes. You need to create your own header by implementing System.ServiceModel.Channels....


5

There's a different login flow that's intended for other devices where this local webserver setup isn't feasible, but it's actually a great way of dealing with this exact issue on desktops too! You may need to use the command line directly instead of invoking via the command palette, but it's a simple command: sfdx force:auth:device:login It gives you a code ...


5

The response of {"active": false} is only allowed in very specific context. From oAuth Introspection spec (RFC 7662): If the introspection call is properly authorized but the token is not active, does not exist on this server, or the protected resource is not allowed to introspect this particular token, then the authorization server MUST return an ...


4

For Rest API (Force.com-JavaScript-REST-Toolkit), we have created one more API to get current authenticate user information. You can find more details at link Please let me know in case of any other information required.


4

I'd just like to bring it to peoples attention that it's redirect_uri and not redirect_url It's given in the Chatter REST API documentation as the second incorrect one - I just spent a few hours on this issue :|


4

I think I've had that problem in the past, and it was down to how the assertion was being encoded. I used this online Base64URL encoder to try and match up how the assertion looked after it was Base64URL Encoded. http://kjur.github.io/jsjws/tool_b64uenc.html I would also look at the login history of the User you're trying to login as on Salesforce as that ...


4

As I noted in a comment above, if your organization is set up to use SAML as the means of authentication (which requires a MySalesforce URL), then the SDK should redirect authentication to the SAML authentication page in question rather than the OAuth page. This does require your application to reference the MySalesforce URL for authentication rather than ...


4

No - the only callback you can use with plain HTTP is localhost. This is to ensure the security of the tokens.


Only top voted, non community-wiki answers of a minimum length are eligible