Understanding authentication for Apex SOAP web service The Next CEO of Stack Overflow2019 Community Moderator ElectionAuthentication for custom Apex SOAP web serviceHow do I install and preauthorize app so I can use the JWT Bearer token flow?Workflow Outbound Message to Salesforce Web ServiceMatching a WebService class to an inbound requestSalesforce: APEX Test Class for Web ServiceClient certificate authentication on web service callout in SalesforceSelf Singed Certificate for Mutual TLSAuthentication for custom Apex SOAP web serviceWebService CertificateImplementing Two Way SSL Certificates for authenticationAccessing a Webservice Apex Method via SOAP-UIReceiving invalid error messages in Apex for failing to specify a refresh token (Oauth2)
What is the result of assigning to std::vector<T>::begin()?
How do scammers retract money, while you can’t?
Would this house-rule that treats advantage as a +1 to the roll instead (and disadvantage as -1) and allows them to stack be balanced?
What benefits would be gained by using human laborers instead of drones in deep sea mining?
Sending manuscript to multiple publishers
What connection does MS Office have to Netscape Navigator?
I believe this to be a fraud - hired, then asked to cash check and send cash as Bitcoin
Why do we use the plural of movies in this phrase "We went to the movies last night."?
How to count occurrences of text in a file?
Novel about a guy who is possessed by the divine essence and the world ends?
What is the purpose of the Evocation wizard's Potent Cantrip feature?
Anatomically Correct Strange Women In Ponds Distributing Swords
If a black hole is created from light, can this black hole then move at speed of light?
Elegant way to replace substring in a regex with optional groups in Python?
Non-deterministic sum of floats
Is there a difference between "Fahrstuhl" and "Aufzug"
If the heap is initialized for security, then why is the stack uninitialized?
What does convergence in distribution "in the Gromov–Hausdorff" sense mean?
Giving the same color to different shapefiles in QGIS
Can I equip Skullclamp on a creature I am sacrificing?
FBX seems to be empty when imported into Blender
How fast would a person need to move to trick the eye?
Do I need to enable Dev Hub in my PROD Org?
Return the Closest Prime Number
Understanding authentication for Apex SOAP web service
The Next CEO of Stack Overflow2019 Community Moderator ElectionAuthentication for custom Apex SOAP web serviceHow do I install and preauthorize app so I can use the JWT Bearer token flow?Workflow Outbound Message to Salesforce Web ServiceMatching a WebService class to an inbound requestSalesforce: APEX Test Class for Web ServiceClient certificate authentication on web service callout in SalesforceSelf Singed Certificate for Mutual TLSAuthentication for custom Apex SOAP web serviceWebService CertificateImplementing Two Way SSL Certificates for authenticationAccessing a Webservice Apex Method via SOAP-UIReceiving invalid error messages in Apex for failing to specify a refresh token (Oauth2)
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
asked 2 days ago
utmutm
34719
add a comment |
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
asked 2 days ago
utmutm
34719
add a comment |
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
asked 2 days ago
utmutm
34719
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
apex webservices authentication apex-webservice
asked 2 days ago
utmutm
34719
asked 2 days ago
utmutm
34719
asked 2 days ago
utmutm
34719
asked 2 days ago
utmutm
34719
asked 2 days ago
utmutm
34719
34719
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered 2 days ago
David ReedDavid Reed
38.5k82356
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
2 days ago
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed
2 days ago
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "459"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsalesforce.stackexchange.com%2fquestions%2f255539%2funderstanding-authentication-for-apex-soap-web-service%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered 2 days ago
David ReedDavid Reed
38.5k82356
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
2 days ago
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed
2 days ago
add a comment |
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered 2 days ago
David ReedDavid Reed
38.5k82356
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
2 days ago
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed
2 days ago
add a comment |
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered 2 days ago
David ReedDavid Reed
38.5k82356
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered 2 days ago
David ReedDavid Reed
38.5k82356
answered 2 days ago
David ReedDavid Reed
38.5k82356
answered 2 days ago
David ReedDavid Reed
38.5k82356
answered 2 days ago
David ReedDavid Reed
38.5k82356
38.5k82356
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
2 days ago
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed
2 days ago
add a comment |
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
2 days ago
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed
2 days ago
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
2 days ago
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
2 days ago
1
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed
2 days ago
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed
2 days ago
add a comment |
Thanks for contributing an answer to Salesforce Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsalesforce.stackexchange.com%2fquestions%2f255539%2funderstanding-authentication-for-apex-soap-web-service%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
