Hot answers tagged

23

A session ID identifies a user using the UI or an API/integration tool. It has a set time to live and may be manually expired by explicitly logging out. It may also be tied to a specific IP address, if configured. Session ID values are valid across all APIs, including SOAP and REST endpoints. Access Tokens are used by Connected Apps and other OAuth-enabled ...


23

So, as it turns outs there is no way of getting a valid API-capable Session Id from lightning component, here is a quote from the partner discussion forums: Three things: There's no $Api global variable in Lightning Components today. So, {! $Api.whatever } will always fail. This is intentional at this time. There's no official/supported way to ...


16

As I know: Session Id: SessionId is obtaines when use login from web interface or does a soap api call. A session is bind by user login time and activity and expires after if user remain idle for specific time. AccessToken: Access token is a part of standard OAuth flow. It allows to do operation on behalf of user which authorize a connected app or other ...


15

Per the documentation: Global variables - $Api You can use this expression in your VF page markup. {!$Api.Session_ID}


14

Sessions expire after the specified amount of idle time (see below), rather than an absolute time period. So, assuming your session timeout is at least an hour, you will keep it active by making a call every hour. I wouldn't rely on this behavior for the long term, though. If the org admin reduces the session timeout, you will find your batch job failing. A ...


13

I think the only way you can use your Session ID for frontdoor.jsp is if it was generated in the context of a first class Salesforce session: ie $Api.Session_ID on a Custom Link or Custom Button appearing on a native page layout on the *.salesforce.com domain or *.my.salesforce.com (per 'My Domain' feature), or Developer Console (tooling API), Eclipse ...


12

You will need to establish a session from within the Scheduled job. As a proof of concept I managed to get this working by using the OAuth 2.0 Username-Password Flow. You make a HTTP POST request from Salesforce-to-Salesforce to request an Access Token which can then be used as a Session ID. You will need to create a new Remote Access Application where you ...


9

Unfortunately, I don't have an answer for you in terms of a workaround. I did spend some time trying to figure this out because I have a package that makes use of getSelected() on a list view and is in use in lots of orgs so was/am concerned about this breaking too. I'm now of the opinion that the problem is org specific. Here are the tests that I ...


8

You can get the session token from the cookie of the browser. The name of the cookie is 'sid'. In Chrome, you can find the cookie by going to settings->advanced settings->privacy->content settings->allcookie and site data and then seacrch for yourinstance.salesforce.com and select the sid cookie and the copy the content of this cookie.


7

I have seen client id's and some passwords which need to be urlencoded/escaped to work well with curl. Maybe you should try the --data-urlencode option (source: https://stackoverflow.com/questions/10060093/special-characters-like-and-in-curl-post-data ) Example usage would be: curl -v https://test.salesforce.com/services/oauth2/token -d "grant_type=...


7

You can accomplish this with Auth.SessionManagement class methods. The code below sets the isTrustedIp variable based on whether or not the running user's IP address is in the trusted ranges (as defined in Setup > Network Access > Trusted IP Ranges): Boolean isTrustedIp = false; Map<String, String> sessionAttributes; try { ...


6

Here's my suggestion: Use Outbound Messaging, which contains the capability to pass the Session ID for the purpose of you using it to call back. Set up a workflow rule on a custom object to fire when a record is changed and send the outbound message. Use your scheduled job to modify the custom object, thus firing the workflow rule and sending the outbound ...


6

Received an answer from Salesforce support: First of all, header parameter names listed in the documentation are wrong. They should be: X-LIVEAGENT-AFFINITY X-LIVEAGENT-SESSION-KEY X-LIVEAGENT-SEQUENCE X-LIVEAGENT-API-VERSION (this is the only one correctly named in the docs) To have the sessionId call return the affinity token, along with the X-...


6

Use an incognito window or a different browser. You should only experience this issue if both orgs are on the same instance, e.g. cs12.


5

The correct format for the Authorization header is Authorization: Bearer {access_token} e.g. if your access token value is bobsaccesstoken then the header should be Authorization: Bearer bobsaccesstoken So your code needs changing to 'Authorization: Bearer ' . $accessToken


5

I think I got the answer that I was looking for. Here is what I did... Set the session timeout settings to 30 minutes Launched my VF page Allowed it to run, by itself, for about an hour. During this time the Remote Actions were triggered about every minute or so. I received no errors. I can only assume that this means that the Remote Actions triggered ...


5

There are a couple of methods via the Partner API that can be used to end active Sessions. logout() "Ends the session of the logged-in user." invalidateSessions() "Ends one or more sessions specified by a sessionId." Using these with your current Salesforce Session Id will kick out both users logged in via a web browser and those active via the ...


5

Set up My Domain in your production org, then refresh your sandboxes. They'll each get unique domains, and will allow you to work seamlessly in multiple orgs. The URL for each sandbox will change to something like "https://mydomainname--sandboxname.instance.my.salesforce.com/". This lets you open many sandboxes with virtually zero risk of sessions getting ...


5

Just an update for anyone facing the same issue. After raising a case with SF we could confirm that the refresh function is only triggered to get new session Id in case the previous callout return '401' status code only (Only way for SF to know that the session is expired)


4

I suspect your apex won't be run if there will be a timeout (meaning that for all practical purposes you can treat UserInfo.getSessionId() as never null). Can you wrap your methods in client-side check? var currentTime=new Date().getTime(); var sessionTimeLeft=secondsLeftValue-((currentTime-lastPageActivityTime)/1000); alert(sessionTimeLeft); It's based ...


4

Yes. It is stored in a cookie named sid so a var sid = document.cookie.match('sid=([^;]*)')[1]; Should do the work. Or if you want something simpler to read var strCookies = document.cookie; var cookiearray = strCookies.split(';') for(var i=0; i<cookiearray.length; i++){ name = cookiearray[i].split('=')[0]; value = cookiearray[i].split('=')[1]; ...


4

The problem is with this line here param.putAll(ApexPages.currentPage().getParameters()); and in particular with the save_new parameter that is being added to the URL causing the error. Similar issue here, Error while PrePopulating Name in Opportunity


4

It works pretty much as you've suggested. Send the users browser to: https://eu5.salesforce.com/secur/frontdoor.jsp?sid=sessionId&retURL=%2F0032400000GRVvYAAX Remember to URL encode the forward slash in the retURL parameter. As Rahul Sharma commented, check the casing of retURL as well. The casing needs to match exactly.


3

Instead of using PageReference.getContent can you use an HttpRequest to achieve the same? Something like: HttpRequest request = new HttpRequest(); request.setMethod('GET'); request.setEndpoint(Url.getSalesforceBaseUrl().toExternalForm() + '/home/home.jsp'; request.setHeader('Cookie', 'sid=' + UserInfo.getSessionId()); HttpResponse response = new Http()....


3

No, the only legal values are the ones specified by salesforce.com. You could create a sidebar component to enforce a custom timeout, but that would only affect browser sessions and not API sessions.


3

It's 2019... Now salesforce has provided ability to capture the logout event by releasing an object LogoutEventStream as a beta feature. After LogoutEventStream is enabled, Salesforce publishes logout events when users log out from the UI. You can add an Apex trigger to subscribe to those events. You can then implement custom logic during logout. For ...


3

Can't help you with JS code, but I can with APEX. There's a freebie Stop Watch class that's part of Apex Utilities which you can get from either the App Exchange or get the source code here. If you downloaded the source code, I'd think you could readily incorporate portions of it into a custom controller for your wizard.


3

Following @eric's recommendation, I was able to use login() which indeed seems to return a full powered first-class sessionId - at least for my requirement I finally got the logs! Instead of using the WSDL I found a much simpler way to use the AJAX Toolkit just with sforce.connection.login(username,passwordAndToken); In the end it will do the same callout ...


3

You can do this using the JWT Bearer Token flow. Basically you register an OAuth app and authorize that app for the users you wish to impersonate. Now your future method will create a JWT Bearer Token containing the target user's username and exchange that for an access token with which you can call the REST API. There is code to do this linked from this ...


3

I just tested a very basic Bulk API Job to insert two new contacts. At the same time I created a new trigger for before insert on contacts that contained the following: string sessionId = UserInfo.getSessionId(); System.debug(LoggingLevel.Error, 'UserInfo.getSessionId(): ' + sessionId); System.assert(!string.isBlank(sessionId), 'Expected sessionId'); The ...


Only top voted, non community-wiki answers of a minimum length are eligible