Understanding authentication for Apex SOAP web service Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 23, 2019 at 00:00UTC (8:00pm US/Eastern) 2019 Moderator Election Q&A - Questionnaire 2019 Community Moderator Election ResultsAuthentication for custom Apex SOAP web serviceHow do I install and preauthorize app so I can use the JWT Bearer token flow?Workflow Outbound Message to Salesforce Web ServiceMatching a WebService class to an inbound requestSalesforce: APEX Test Class for Web ServiceClient certificate authentication on web service callout in SalesforceSelf Singed Certificate for Mutual TLSAuthentication for custom Apex SOAP web serviceWebService CertificateImplementing Two Way SSL Certificates for authenticationAccessing a Webservice Apex Method via SOAP-UIReceiving invalid error messages in Apex for failing to specify a refresh token (Oauth2)
MLE of the unknown radius
Should I use a zero-interest credit card for a large one-time purchase?
Is it possible for SQL statements to execute concurrently within a single session in SQL Server?
What is the meaning of 'breadth' in breadth first search?
Do wooden building fires get hotter than 600°C?
Central Vacuuming: Is it worth it, and how does it compare to normal vacuuming?
Why does it sometimes sound good to play a grace note as a lead in to a note in a melody?
I want to complete my figure
Is there any word for a place full of confusion?
Parallel Computing Problem
How would a mousetrap for use in space work?
How could we fake a moon landing now?
Why do early math courses focus on the cross sections of a cone and not on other 3D objects?
What is the difference between globalisation and imperialism?
Selecting user stories during sprint planning
Project Euler #1 in C++
What order were files/directories outputted in dir?
Is it fair for a professor to grade us on the possession of past papers?
Why is Nikon 1.4g better when Nikon 1.8g is sharper?
Significance of Cersei's obsession with elephants?
How to run automated tests after each commit?
Putting class ranking in CV, but against dept guidelines
How fail-safe is nr as stop bytes?
Did any compiler fully use 80-bit floating point?
Understanding authentication for Apex SOAP web service
Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 23, 2019 at 00:00UTC (8:00pm US/Eastern)
2019 Moderator Election Q&A - Questionnaire
2019 Community Moderator Election ResultsAuthentication for custom Apex SOAP web serviceHow do I install and preauthorize app so I can use the JWT Bearer token flow?Workflow Outbound Message to Salesforce Web ServiceMatching a WebService class to an inbound requestSalesforce: APEX Test Class for Web ServiceClient certificate authentication on web service callout in SalesforceSelf Singed Certificate for Mutual TLSAuthentication for custom Apex SOAP web serviceWebService CertificateImplementing Two Way SSL Certificates for authenticationAccessing a Webservice Apex Method via SOAP-UIReceiving invalid error messages in Apex for failing to specify a refresh token (Oauth2)
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
asked Mar 27 at 16:08
utmutm
35219
add a comment |
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
asked Mar 27 at 16:08
utmutm
35219
add a comment |
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
asked Mar 27 at 16:08
utmutm
35219
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
apex webservices authentication apex-webservice
asked Mar 27 at 16:08
utmutm
35219
asked Mar 27 at 16:08
utmutm
35219
asked Mar 27 at 16:08
utmutm
35219
asked Mar 27 at 16:08
utmutm
35219
asked Mar 27 at 16:08
utmutm
35219
35219
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered Mar 27 at 16:23
David Reed♦David Reed
39.5k82357
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
Mar 27 at 17:41
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed♦
Mar 27 at 18:11
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "459"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsalesforce.stackexchange.com%2fquestions%2f255539%2funderstanding-authentication-for-apex-soap-web-service%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered Mar 27 at 16:23
David Reed♦David Reed
39.5k82357
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
Mar 27 at 17:41
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed♦
Mar 27 at 18:11
add a comment |
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered Mar 27 at 16:23
David Reed♦David Reed
39.5k82357
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
Mar 27 at 17:41
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed♦
Mar 27 at 18:11
add a comment |
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered Mar 27 at 16:23
David Reed♦David Reed
39.5k82357
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered Mar 27 at 16:23
David Reed♦David Reed
39.5k82357
answered Mar 27 at 16:23
David Reed♦David Reed
39.5k82357
answered Mar 27 at 16:23
David Reed♦David Reed
39.5k82357
answered Mar 27 at 16:23
David Reed♦David Reed
39.5k82357
39.5k82357
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
Mar 27 at 17:41
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed♦
Mar 27 at 18:11
add a comment |
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
Mar 27 at 17:41
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed♦
Mar 27 at 18:11
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
Mar 27 at 17:41
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
Mar 27 at 17:41
1
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed♦
Mar 27 at 18:11
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed♦
Mar 27 at 18:11
add a comment |
Thanks for contributing an answer to Salesforce Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsalesforce.stackexchange.com%2fquestions%2f255539%2funderstanding-authentication-for-apex-soap-web-service%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
