Understanding authentication for Apex SOAP web service
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
asked Mar 27 at 16:08
utmutm
35219
add a comment |
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
asked Mar 27 at 16:08
utmutm
35219
add a comment |
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
asked Mar 27 at 16:08
utmutm
35219
I have read this post: How authentication works in APEX and since the SF documentation is a bit confusing for me at this point I would like to ask:
Is it possible to get the session id with a certificate instead of e.g. username/pass combination?
I know the possibility to save such a certificate in the 'named credential' section but this would be for the outbound calls. So I would like to know if this is also possible for the other direction? And if so-how would this work?
My first idea was to create a connected app and save this (e.g. self signed or whatever) certificate there? And with this it would be possible to get the session ID and with this session ID the webservice (Apex Class) could be called?
Would be this the right/possible way to do this or am I completly on the wrong track?
apex webservices authentication apex-webservice
apex webservices authentication apex-webservice
asked Mar 27 at 16:08
utmutm
35219
asked Mar 27 at 16:08
utmutm
35219
asked Mar 27 at 16:08
utmutm
35219
asked Mar 27 at 16:08
utmutm
35219
asked Mar 27 at 16:08
utmutm
35219
35219
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered Mar 27 at 16:23
David Reed♦David Reed
39.1k82356
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
Mar 27 at 17:41
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed♦
Mar 27 at 18:11
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "459"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsalesforce.stackexchange.com%2fquestions%2f255539%2funderstanding-authentication-for-apex-soap-web-service%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered Mar 27 at 16:23
David Reed♦David Reed
39.1k82356
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
Mar 27 at 17:41
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed♦
Mar 27 at 18:11
add a comment |
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered Mar 27 at 16:23
David Reed♦David Reed
39.1k82356
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
Mar 27 at 17:41
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed♦
Mar 27 at 18:11
add a comment |
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered Mar 27 at 16:23
David Reed♦David Reed
39.1k82356
Certificate-based authentication is possible via the JWT Oauth flow, and you're on the right track vis-a-vis how to implement it (you do create a Connected App and populate a certificate there).
It's not the right way to handle authentication for an Apex web service, but it's a right way. It's applicable to situations where you have headless servers talking to one another without any explicit user intervention or authorization, and where the remote client (off-Salesforce) can protect a secret - the private key for the certificate.
One really important thing to remember is that the remote app, which holds the private key, can authenticate as any user whose Profile or Permission Set is authorized on your Connected App. Proper setup is critical for a secure solution.
This Oauth flow is documented here. For more resources on setting it up, I previously wrote an answer with some useful links drawn from Salesforce DX and CI setup documentation.
answered Mar 27 at 16:23
David Reed♦David Reed
39.1k82356
answered Mar 27 at 16:23
David Reed♦David Reed
39.1k82356
answered Mar 27 at 16:23
David Reed♦David Reed
39.1k82356
answered Mar 27 at 16:23
David Reed♦David Reed
39.1k82356
39.1k82356
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
Mar 27 at 17:41
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed♦
Mar 27 at 18:11
add a comment |
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
Mar 27 at 17:41
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed♦
Mar 27 at 18:11
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
Mar 27 at 17:41
Thx for your answer! So do I understand it right, that the 'worst' thing with authentication through certs (connected app) is the permission problem? And-what is the best method?
– utm
Mar 27 at 17:41
1
1
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed♦
Mar 27 at 18:11
@utm I don't think there's a prescriptive 'best' - it's very case specific! The permissions thing is just something to be aware of as you're implementing the solution. It does not have to be a problem.
– David Reed♦
Mar 27 at 18:11
add a comment |
Thanks for contributing an answer to Salesforce Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsalesforce.stackexchange.com%2fquestions%2f255539%2funderstanding-authentication-for-apex-soap-web-service%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
