Understanding authentication for Apex SOAP web service2019 Community Moderator ElectionAuthentication for custom Apex SOAP web serviceHow do I install and preauthorize app so I can use the JWT Bearer token flow?Workflow Outbound Message to Salesforce Web ServiceMatching a WebService class to an inbound requestSalesforce: APEX Test Class for Web ServiceClient certificate authentication on web service callout in SalesforceSelf Singed Certificate for Mutual TLSAuthentication for custom Apex SOAP web serviceWebService CertificateImplementing Two Way SSL Certificates for authenticationAccessing a Webservice Apex Method via SOAP-UIReceiving invalid error messages in Apex for failing to specify a refresh token (Oauth2)
What does the word "Atten" mean?
Different result between scanning in Epson's "color negative film" mode and scanning in positive -> invert curve in post?
Proof of work - lottery approach
Is the destination of a commercial flight important for the pilot?
Is exact Kanji stroke length important?
Is oxalic acid dihydrate considered a primary acid standard in analytical chemistry?
Implement the Thanos sorting algorithm
Pre-amplifier input protection
Roman Numeral Treatment of Suspensions
How to Reset Passwords on Multiple Websites Easily?
What is the best translation for "slot" in the context of multiplayer video games?
Did Dumbledore lie to Harry about how long he had James Potter's invisibility cloak when he was examining it? If so, why?
Inappropriate reference requests from Journal reviewers
How do I go from 300 unfinished/half written blog posts, to published posts?
Would a high gravity rocky planet be guaranteed to have an atmosphere?
Class Action - which options I have?
Closest Prime Number
Why escape if the_content isnt?
You cannot touch me, but I can touch you, who am I?
India just shot down a satellite from the ground. At what altitude range is the resulting debris field?
Is a stroke of luck acceptable after a series of unfavorable events?
Large drywall patch supports
Sequence of Tenses: Translating the subjunctive
Trouble understanding the speech of overseas colleagues
Understanding authentication for Apex SOAP web service
2019 Community Moderator ElectionAuthentication for custom Apex SOAP web serviceHow do I install and preauthorize app so I can use the JWT Bearer token flow?Workflow Outbound Message to Salesforce Web ServiceMatching a WebService class to an inbound requestSalesforce: APEX Test Class for Web ServiceClient certificate authentication on web service callout in SalesforceSelf Singed Certificate for Mutual TLSAuthentication for custom Apex SOAP web serviceWebService CertificateImplementing Two Way SSL Certificates for authenticationAccessing a Webservice Apex Method via SOAP-UIReceiving invalid error messages in Apex for failing to specify a refresh token (Oauth2)
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
asked 11 hours ago
utmutm
34719
add a comment |
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
asked 11 hours ago
utmutm
34719
add a comment |
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
asked 11 hours ago
utmutm
34719
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
apex webservices authentication apex-webservice
asked 11 hours ago
utmutm
34719
asked 11 hours ago
utmutm
34719
asked 11 hours ago
utmutm
34719
asked 11 hours ago
utmutm
34719
asked 11 hours ago
utmutm
34719
34719
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered 10 hours ago
David ReedDavid Reed
38.3k82356
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
9 hours ago
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed
8 hours ago
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "459"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsalesforce.stackexchange.com%2fquestions%2f255539%2funderstanding-authentication-for-apex-soap-web-service%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered 10 hours ago
David ReedDavid Reed
38.3k82356
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
9 hours ago
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed
8 hours ago
add a comment |
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered 10 hours ago
David ReedDavid Reed
38.3k82356
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
9 hours ago
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed
8 hours ago
add a comment |
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered 10 hours ago
David ReedDavid Reed
38.3k82356
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered 10 hours ago
David ReedDavid Reed
38.3k82356
answered 10 hours ago
David ReedDavid Reed
38.3k82356
answered 10 hours ago
David ReedDavid Reed
38.3k82356
answered 10 hours ago
David ReedDavid Reed
38.3k82356
38.3k82356
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
9 hours ago
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed
8 hours ago
add a comment |
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
9 hours ago
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed
8 hours ago
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
9 hours ago
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
9 hours ago
1
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed
8 hours ago
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed
8 hours ago
add a comment |
Thanks for contributing an answer to Salesforce Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsalesforce.stackexchange.com%2fquestions%2f255539%2funderstanding-authentication-for-apex-soap-web-service%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
