20
votes
Accepted
Pros and cons of user-agent flow vs web server flow
The User Agent (UA) and Web Server (WS) flows have two different security purposes. The main difference is that UA is used for untrusted clients, while WS is used for a server application; the WS uses ...
- 481k
17
votes
Salesforce: Any API for getting user information?
There is an actual endpoint for this now as well: https://login.salesforce.com/services/oauth2/userinfo
See here for the help document
- 271
12
votes
Accepted
OAuth interactions: do they count as API calls?
After hammering the login.salesforce.com endpoints today (and getting blocked a couple of times), I've established (at least to my satisfaction) that the OAuth interactions around granting access ...
- 13.6k
11
votes
Accepted
Authentication Failure when submitting Authorization Code in OAuth Web-Server Flow
Are you copying your authorization code from browser redirect? Its getting URL encoded and hence its saying invalid authorization code.
Check if your auth code is ending with "%3D%3D" replace that ...
- 35.8k
10
votes
Accepted
oAuth - Introspection endpoint says a valid access token is inactive
The response of {"active": false} is only allowed in very specific context. From oAuth Introspection spec (RFC 7662):
If the introspection call is properly authorized but the token is not
active, ...
- 7,255
8
votes
Accepted
Username-Password OAuth Authentication for community users?
In the profile of the user make it as API enabled.
I was able to log in using api inside the community using the below soap login call.,
<Envelope xmlns="http://schemas.xmlsoap.org/soap/envelope/"...
- 35.8k
7
votes
Accepted
Security Review Oauth Callback "Insecure Storage of Sensitive Data"
My solution for determining the users email address is going to be to make a SOQL query to the sObject 'User' immediately after the OAuth flow completes. Is there something similar I can do for ...
- 102k
7
votes
Accepted
Salesforce OAuth 2.0 JWT Bearer Token Flow - Token Expiration
The length of time that your access token is valid is determined by the session timeout value in the Connected App's policies. By default, I believe that this timeout is not set, in which case the ...
- 59.4k
6
votes
Accepted
Difference between Authentication and Identity Provider
Short answer is yes. Salesforce can be Authentication Provider and Identity Provider at same time.
The main difference between Authentication Provider and Identity provider is -
Identity Provider :...
- 29.4k
6
votes
Accepted
OAuth Authorization Flow for AppExchange Packages
Yes
From the doc:
AppExchange Partners: Request Tokens on Your Customer’s Behalf
Multitenant AppExchange partners that use web app integrations with
Marketing Cloud must be prepared to ...
- 7,255
6
votes
oAuth - Introspection endpoint says a valid access token is inactive
Haven't found any documentation to support this, so it's just speculation, but based on the lack of any mention of an "active" parameter (outside of child sessions) in the documentation on ...
- 59.4k
5
votes
Accepted
Server to Server JWT Authentication Certificate management
The JWT Authentication Flow can be initiaded using the usual OAuth2 Authorization Flow.
Setup:
Setup the App, get the required client_key and client_secret Build > Create > Apps
Create a new Keypair ...
- 161
5
votes
Pros and cons of user-agent flow vs web server flow
Coming back to answer my own question. The answers above were true at the time but IETF no longer recommends using User Agent at all. As well, Web Server flows have been updated to not require a ...
- 1,057
5
votes
Accepted
OAuth implementation in SOAP API (C#)
I recently had some challenges adding a SOAP Header when creating a Universal Windows Platform (UWP) application in .NET against the SOAP based APIs.
The problem was that the WCF tooling for ...
- 102k
5
votes
Cannot connect a Salesforce org using Authorize an org in VS Code
There's a different login flow that's intended for other devices where this local webserver setup isn't feasible, but it's actually a great way of dealing with this exact issue on desktops too!
You ...
- 25.4k
5
votes
Accepted
Locking Down OAuth App Access in our Salesforce Org
I belive you are looking for API client whitelisting. You can get it enabled by raising a case with Saleforce.
Please do verify how it impacts the current connected apps before enabling it.
You can ...
- 7,973
5
votes
Why don't I get a new refresh token when I refresh an access token in Salesforce?
Access Tokens are governed through the global Session Settings or the Profile Session Settings, while Refresh Tokens are controlled via OAuth Access Policies. You simply reuse a Refresh Token as long ...
- 481k
4
votes
Accepted
JWT Oauth flow Confusion
JWT doesn't sound like the correct solution to your problem but to expand on Keith's answer a bit:
The JWT OAuth flow is predicated on a previously set up mutual trust between you (the app developer) ...
- 22.9k
4
votes
OAuth 2.0 JWT Bearer Token Flow giving a user hasn't approved this consumer error
Based from the salesforce documentation:
The authorization server validates the JWT and issues an access_token
based upon prior approval of the application.
It means you have to authorize the ...
- 41
4
votes
Accepted
Canvas Signed Request vs OAuth flow
Signed request is completely secure while oauth flow is provided in case you want to do two way oauth and also alert the user that he is allowing access to the resources .
When you do an oauth flow ,...
- 90.5k
4
votes
Accepted
What is the value of using an OAuth flow for your own external systems
Storing the username and password - Ultimately something has to be stored, and an access token can be used to access resources just as easily as a username and password.
That's one point of view, but ...
- 481k
4
votes
Metadata API: where is the Connected App / OAuth policies / Permitted Users setting?
As far as I can tell, it's not supported by the Metadata API. What's weird, however, is that there's no mention of permissions under ConnectedApp, which suggests that it is not supported, but it's ...
- 481k
4
votes
Security Review Oauth Callback "Insecure Storage of Sensitive Data"
Insecure Storage of Sensitive Data refers to storage of passwords in insecure locations such as unencrypted custom fields or public custom settings.
It has nothing to do with transport (even of ...
- 3,206
4
votes
Named Credentials - Refresh Token - Google APIS
In the Auth. Provider, set Provider Type to 'Open ID Connect' (not 'Google'), and in 'Authorize Endpoint URL' put 'https://accounts.google.com/o/oauth2/auth?access_type=offline&approval_prompt=...
- 639
4
votes
Tie web server oauth to user session in my canvas app
This question is, effectively, asking the difference between authorization and authentication.
OAuth 2.0 is an authorization standard. The access token you receive from the server authorizes you to ...
- 4,029
4
votes
(400) - Bad Request when requesting auth token using Wordpress
So I got it working.
I had to change the Content-Type header to application/x-www-form-urlencoded, which I tried because of this answer.
Unfortunately the docs don't tell you that. In fact they say ...
- 71
4
votes
Accepted
Google OAuth and UI - is is possible to pass back the authorization code not in the URL?
That approach should work - I've made this work with the refresh token to retrieve Google Analytics data each night. I store the refresh token in a setting, and when I need to access GA, I get a new ...
- 13.5k
4
votes
Is session duration guaranteed?
Separating your questions.
My question is however, is this value of 2 hours guaranteed as a
minimum session length? Will it always be at least 2 hours?
Yes and No (No if a User ends the ...
- 30.3k
4
votes
JWT Bearer flow vs. Username+Password flow in server-to-server integration
I think it is similar to why passwords in db are not stored in straight way, but hashed values are stored. In case, when someone not allowed will get access to it - he will not be able to operate with ...
- 18.2k
4
votes
Expired authorization code and Invalid Nonce errors
Basically, this error is saying that Salesforce has detected a "replay attack" scenario. A nonce is a random, unique value generated for each login attempt in certain login flows. If the same nonce is ...
- 481k
Only top scored, non community-wiki answers of a minimum length are eligible