Hot answers tagged

4

I'm not set up to test the scenario you've laid out precisely, but I was able to repoduce the error using what I imagine is equivalent code in the developer console. Looks like the -r/--instanceurl flag maps to the aud (audience) parameter for the JWT. Instead of trying to use the domain for a specific instance (which doesn't work in my testing), you should ...


4

If you have the access token or a session id (but preferably the access token), then you don't need anything else. It's getting the access token that requires the connected app and the user details. There are a selection of OAuth 2.0 flows. The flow you're currently using is the username-password flow, which is only recommended for testing. The consumer key (...


3

I have to use a @future method to get the Access Token since it is being called from a trigger Minor correction: you have to use Asynchronous Apex. You don't have to use an @future method; you just must leave the trigger context. I cant return the token to a public variable in the class Correct, but it wouldn't matter anyway because you can't use that ...


3

One option is to use Merge Fields for Apex Callouts That Use Named Credentials. This won't explicitly give you access to the data from the named credential in Apex, but it will allow you to alter how it is used in any callout. For example, you could define custom request headers: // non-standard authentication req.setHeader('X-Username', '{!$Credential....


3

After some research, I was able to make it work. Adding the solution for all those who are looking to implement the PKCE flow for salesforce. I got huge help from This link. The salesforce document is missing one parameter which is code_challenge_method=S256 in the authorization URL. Here is the full URL for the authorization request. https://login....


3

Username and Password is definitely not recommended as the article says you are passing along the username and password and also there is a need to securely store these. In your case, you should use JWT Server-Server flow. In this flow, you also do not need a client secret. Note in JWT flow as well you should protect your JWT token. In the case of ...


2

As per the docs it is clearly stated that your code_challenge value should be base64url encoded and also the code verifier should be 128 bytes random string! Also looks like the docs have missed mentioning about parameter code_challenge_method=S256 in the authorization request. This needs to be corrected! Try to base64 URL encode your code_challenge in the ...


2

Yes, this counts both as an API call for purposes of daily limits, and a login/hour limit (3,600 login calls per hour).


2

The best secure way would be to use a Connected App and Server-Server flow It is always better to authenticate to Salesforce and reach into Salesforce using a connected app. However, as you pointed that if you do not have a lot of control then you need a proxy server doing this for you. One approach would be to use a Heroku Node.js app and exposing that to a ...


2

Ok, I was able to get this to work using JWT Flow, Named Credential and Identity User (full disclosure, I've only played with Named Credentials now for all of 45 minutes, so my approach may need to get vetted by smarter people than I). Create Identity User in Salesforce, Create same user in Pardot and link them via CRM Username. Be sure to activate and ...


2

Generally speaking, you have two options. The first option is to set up a server on localhost, and listen for a connection from the browser at the end of the flow. This is often something like https://localhost:1717/oauth/success. This is how the Salesforce DX CLI operates. The second option is to listen to a WebView or similar component for when you land on ...


2

I was able to use OP's workaround in a Sandbox with the instanceurl option: sfdx force:auth:device:login --instanceurl https://test.salesforce.com --setdefaultusername I also used a "my" domain successfully.


2

It depends a bit on your requirements. If your Identity provider can work with OpenIdConnect I would configure this as a Salesforce Auth. provider and then use a custom registration handler using the RegistrationHandler interface. This uses the login procedure to identify / create or update users on login. Salesforce documentation here Then you can use the ...


2

From the help page on the JWT flow: Salesforce requires that a JWT is signed using RSA SHA256, which uses an uploaded certificate as the signing secret. HS256 is not accepted by Salesforce (via a connected app and the Salesforce-provided services/oauth2/token service).


2

After forking the collection posted by Aaron Cates, I was able to get the authentication to work! I was correct in my theory that the OAuth2.0 flow was making the token request for me, so I didn't need to make a call to the v2/token endpoint. After securing the access key and trying the v1/validateEmail request recommended in the collection's setup ...


2

This code should not be used to authenticate a user with the web server, only to enable API access to the specified community. In that context, your proposed attack won't allow any access, as the access token is only "valid" for the attack server. It's always important to make sure that you understand the context for the type of code you're writing....


1

This article explains how to create an authorization code and retrieve an access token. I then passed the access token into my fetch request using headers and that resolved my issue: handleSubmit = (event) => { let postDataUrl = '/services/data/v51.0/ui-api/record-ui/'; let authorize = { method: 'POST', headers: { '...


1

I wasn't able to downgrade, was running into an other error there. I've tried login via myDomain and device code without success. My setup was maybe special, dev org created from isv instance .. wasn't trying to hard to fix this as it was for personal testing only. Anyway, I've just updated my Salesforce CLI to version 7.91.0-6a6ed69ebe – and everything is ...


1

Happened to me too. I guess it's got to do with encoding, so this format worked for me: curl --location --request POST 'https://login.salesforce.com/services/oauth2/token' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'grant_type=password' \ --data-urlencode 'username=xxxx' \ --data-urlencode 'password=xxxx' \ --data-...


1

The digital certificate that goes with the connected app will be auto-installed along with the connected app if customers install the app. One thing to consider with this approach is still admins need to set up the Connected app policy. This is a manual set up to add Profiles and Permissions to the OAuth Access Policy. This is not a lot of steps it's just a ...


1

I haven't used it yet myself, you might want to checkout PyPardotSF. https://github.com/anelendata/PyPardotSF Based on the documentation, this library should be a bit more feature-rich than the original as it supports both V3 and V4. There is no mention yet of the V5 API, so if that's important to you then you may need to make adjustments and use what you ...


1

I have found the solution : var url = 'https://test.salesforce.com/services/oauth2/token' + '?client_id=' + client_id + '&client_secret=' + client_secret + '&grant_type=' + grant_type + '&username=' + username + '&password=' + password var req = new Script.Util.HttpRequest(url); req.retries =...


1

So the way you are setting up the payload in the call is off. I believe to make your current setup work, you just need to adjust the content type to "application/x-www-form-urlencoded" like so: req.contentType = "application/x-www-form-urlencoded"; But honestly, I would adjust it to the below to fit better in the SSJS model (utilizing ...


1

Ok, it's fixed and here's the answer if anybody stumbles across it looking for the same. Key issues were: The PASSWORD must be JUST the PW, do NOT add the security key to it Apparently the DEVELOPER account does not use test, but the regular login.salesforce... URL. session_start(); require '../config.inc.php'; $token_url = "https://login.salesforce....


1

same with sfdx-cli/7.82.1-0 linux-x64 node-v10.19.0, installed with npm, I install a new Ubuntu 20.04.1 LTS, visual studio , sfdx cli, chrome(firefox never works), and works fine. the link of @Badbaxx , its very useful , i resolved downgrade using sudo npm -g i sfdx-cli@7.74.1 . The problem i think its there.


1

If want to avoid the "ping" counting towards the API Requests limit, you may be able to use: /services/oauth2/userinfo In this related answer, the author tested and confirmed it doesn't count towards the limit. This endpoint may only be available via oAuth generated tokens with the proper scope.


1

refresh and offline_access scope are Salesforce Core scopes not Salesforce Marketing Cloud scopes. Documentation about Marketing Cloud is terrible but according to these : REST API Permission IDs and Scopes API Integration Permission Scopes Access token app In Marketing Cloud it seems that you always have the right to refresh your token and if you want a ...


1

Turns out, just needed a header... Content-Type: application/x-www-form-urlencoded Guess curl was setting it automatically.


1

For non-interactive applications (e.g. a server connecting to Salesforce), you should look at using the JWT Bearer flow. Be aware that as part of setting up that flow, you'll need to manually go through another flow (one that generates a refresh token, such as the web-server flow) for each org you want to use the connected app in.


1

You cannot strictly speaking do either of these things. How to start the OAuth flow, when a customer install our package via the AppExchange? You'll need to do this from a Setup or Configuration page within your application, or instruct the user in your documentation as to the steps to follow. You can't automate it without user intervention or do it from ...


Only top voted, non community-wiki answers of a minimum length are eligible