6

I've written a custom authprovider which I've shared "as-is" on Github. It implements both the Client Credentials and JWT Bearer variant (without a certificate). Feel free to fork from it. https://github.com/bobbywhitesfdc/ApigeeAuthProvider


4

Just wanted to note that I've managed to acquire a response from Salesforce's support. They confirmed that in their current implementation of OpenID Connect client it will reject self-signed certificates provided by IdPs it connects to. They promised to present the feature to allow such certificates for voting on their forums, and if supported by other users ...


3

Marketing Cloud doesn't support OpenID Connect. SSO is only possible using SFMC's SAML 2.0 implementation.


3

It turns out this gap is resolved in the Spring 14 Salesforce release. http://docs.releasenotes.salesforce.com/en-us/spring14/release-notes/apex_Auth_AuthToken_refreshAccessToken.htm --Edit 09/02/2014 The gap in the Salesforce functionality is resolved with the above method, but the functionality Google offers does not follow the OpenID connect standard ...


2

Salesforce Premier Support has stated: The Custom Auth provider set up in Salesforce would not allow you to enter client credentials and login. The two posts below also confirm this: Custom Auth Provider usage for unattended OAuth flow Named Credentials and support for the OAuth2 Client Credentials Grant Type and alternatives As a solution to the ...


2

Go to Setup > (Company Settings | Domain Management) > My Domain, edit the Authentication Configuration section, and uncheck all settings except for the provider you want to use. Salesforce will then automatically redirect all login requests from your domain to the specified provider. If more than one option is available, users can choose from any of the ...


2

Check out AuthSession object. Just deleting the records of all the active users from this object, will end their session and they have re-login again at which time they will login using Auth2 configuration


2

You'll need to roll your own client that implements the oAuth authorization code flow with PKCE extension. As you found out, Named Credential won't help you. The common wisdom is that tokens should be stored in custom settings and/or custom metadata. The latter can be updated via the Metadata API. You will also need to store the code verifier until it's ...


2

I am able to get custom attributes in the id_token upon enabling Include Custom Attributes as explained in the release notes Following is what I get when I try the flow using https://openidconnect.herokuapp.com/ { "at_hash": "qzgoS_bMJZeqMG891R61HQ", "aud": "3MVG9Y6d_Btp4xp6DzCgTCe.0uVYD_Gk1LZ3Dm8V3DepaqufgLARbdL0snwm8_LrT4mdbN_fBxKYoy0UGOHpj", **"...


2

The OpenID Connect protocol in brief: The RP (Client) sends a request to the OpenID Provider (OP). The OP authenticates the End-User and obtains authorization. The OP responds with an ID Token and possibly an Access Token. The RP can send a request with the Access Token to the UserInfo Endpoint. The UserInfo Endpoint returns Claims about the End-User. In ...


1

On the Salesforce side in the connected app (docs): openid is the only scope needed under Selected OAuth scopes Select Configure ID Token and check Include Standard Claims On the client side (Auth0), don't request any scopes. You can test with https://openidconnect.herokuapp.com as the client. When I do this, I get standard claims in the ID token: { "...


1

Access token and ID token are two different animals. The former is used for authorizing API calls, the latter is used for authentication of end-user by your application/client. You cannot use an ID token to authorize calls, there's no such provision in oAuth and/or OpenID Connect spec. From the docs, the steps involved in Web Server flow (aka authorization ...


1

Yes, it is possible to use SSO with OpenID connect. Follow these steps to configure OpenID connect external auth provider: https://developer.salesforce.com/docs/atlas.en-us.mobile_sdk.meta/mobile_sdk/sso_provider_openid_connect.htm To configure it on Salesforce App (aka Salesforce1), you will need to restrict the org to login exclusively through SSO (...


1

This question is already ask in my knowledge. Please do research before asking question. check this: https://stackoverflow.com/questions/50509667/sign-in-with-google-temporarily-disabled-for-this-app


1

You need to Modify the app settings and set the app domain (or Home Page URL) to Salesforce. Please follow below steps from the link below. https://help.salesforce.com/articleView?id=sso_provider_openid_connect.htm&type=5 I have posted complete steps from above link Complete these steps to configure an OpenID authentication provider. Register your ...


1

Well, if you want to bypass the mandatory PageReference, you could redirect directly to the callback url created in your Auth Provider, example: global PageReference initiate(Map<string,string> authProviderConfiguration, String stateToPropagate) { new PageReference('https://....my.salesforce.com/services/authcallback/YOURAUTHPROVIDER?state=' + ...


1

This was reported to Salesforce as a defect and was eventually accepted by support as an issue. It should be resolved in "Spring 14 or a later major release". For anyone using OpenID Connect, it might also be useful to be aware that Internal Server Errors are currently experienced by a user when logging in using OpenID Connect from an un-activated browser ...


1

Use the published public keys to verify the signature in the response is a valid Salesforce signature. http://releasenotes.docs.salesforce.com/en-us/spring14/release-notes/rn_forcecom_security_public_key.htm Public keys here: https://login.salesforce.com/id/keys


1

The reason you're seeing this error is because of the way you're implemented the use of the OAuth State attribute in your Controller (it doesn't belong there as part of string that's a constant). From the OAuth Documentation: state RECOMMENDED. An opaque value used by the client to maintain state between the request and callback. The authorization ...


1

There could be some other simple way to achieve this but i think one possible way could be by extending ConnectedAppPlugin class.Here you can restrict access.See below image where you can provide this extended class.This option is available on connected app. See this link for more info: ConnectedAppPlugin Class


1

I'll answer my own question. This is part of the Winter 2016 Salesforce release.


1

If I understand correctly, you want capture form data from a logged in user of your website into Salesforce. Am I right, if yes, then you can do web to lead kind of an integration. But however if the use case is that they need to be redirected from your website to Salesforce (with OpenId authentication) seamlessly to fill in a form then: You can configure ...


1

Probably you are looking for this. This has illustrated all the list of steps that would allow you get connected to OpenID oauth2 salesforce auth. https://help.salesforce.com/apex/HTViewHelpDoc?id=sso_provider_openid_connect.htm&language=th


1

Community Users needs a Contact (linked to a valid Contact). So you have to do something like in the createUser method: Account acc = new Account(Name = data.lastname); insert acc;//you can also query an account Contact cnt = new Contact(FirstName = data.firstname, LastName = data.lastname, AccountId = acc.Id); insert cnt;//you can create a PersonAccount ...


1

I know this post is old, but it still pops up as one of the most relevant results for this issue. It would appear that in addition to the best response, the following parameter is now optimal: access_type=offline&prompt=consent, so the auth url would look something like: https://accounts.google.com/o/oauth2/auth?access_type=offline&prompt=consent. ...


Only top voted, non community-wiki answers of a minimum length are eligible