1

I'm setting up External Objects using Salesforce Connect (aka Lightning Connect) and OAuth. I've configured the Authentication Provider to use the OAuth parameters and the External Data Source to use a Named Principal and the OAuth.

The client has opened the firewall for all Salesforce IPs.

My issue is connecting to the OAuth server: If I choose "Start Authentication Flow on Save" my browser attempts to authenticate with the client's OAuth server and, being on my browser, the firewall blocks my IP.

I need to authenticate using a Salesforce IP, ideally using OAuth JWT flow or something that supports server-to-server authentication and not my personal browser.

How can I get Salesforce to authenticate to an OAuth Authentication Provider without using my browser to log in?

As an aside, I've confirmed External Data Sources using Named Principal and Password Authentication do not run through my browser. It's the Authentication Provider settings that are using my browser to log in.

Improve this question
4
  • Don't your client have VPN so you can go through the flow ? Commented May 2, 2020 at 18:52
  • @MohithShrivastava No, but I like that idea better than asking them to open their firewall for my IP address for 5 minutes while I do the OAuth flow. Assuming I get VPN access (or I get my IP opened for 5 minutes), will Salesforce handle the refresh token stuff from a Salesforce IP address or from the browser's IP address? It's no good if I finish the OAuth flow and a month later we have the same firewall issue. Commented May 2, 2020 at 18:54
  • It will do it once from your browser then afterwards the authentication will happen with the refresh token or JWT from Salesforce servers. You can ask your client to do it once inside the network. In case of password flow, the request is made by salesforce so your ip is not in picture. Commented May 2, 2020 at 18:55
  • 1
    Ok cool, so sounds like I need VPN or their firewall to allow my IP and then I'm good. That points me in the right direction, thanks Commented May 2, 2020 at 18:56

2 Answers 2

Reset to default
0

It will do it once from your browser then afterwards the authentication will happen with the refresh token from Salesforce servers. You can ask your client to do it once inside the network. In case of password flow, the request is made by salesforce so your IP is not in picture. 

Do note that at times the authentication expires if the other service is down for a long time.

Improve this answer
0

One approach for this is to get access to the client VPN so you can go through the oauth dance.

Once you are on client VPN you should be able to go through Oauth dance and afterwards the salesforce server stores the access token and refresh token to manage the authentication without manual intervention.Note that for this, the assumption is that the app you are integrating with has followed oauth specification and has implemented refresh token flow that refresh token never expires.

The other approach is to document and coach your client on how to set this up.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.