0

I am trying to Authenticate the Calls to My Odatav4 , In My Service I have started accepting JWT token in header and it is working if i call the service in postman with JWT token in header,

Now in my salesforce Org i am using this service to get External Objects from other system, i need to send JWT token in header when the Salesforce connect calls my Odata4 endpoint,

Salesforce DOcs are really not that helpful.

Any Suggestions would be of great help.

Thanks Arjun.M

Improve this question
4
  • Where from/how is Salesforce getting the JWT? and what header is your ODatav4 service expecting to find the JWT in? Commented Nov 26, 2021 at 15:21
  • Hi Dan Salesforce is not getting JWT , but i have service(Odata) which is expecting JWT token in header, I have added this service in my External Data Source and to get the data from service currently it is configured asNo Authentication, but i need to Pass JWT header with Named Principles or Per user, anything is fine , but In SF i can see is only SOQL query , and SF Connect changes this Query to Odata URL . Commented Dec 1, 2021 at 11:03
  • If you haven't got the JWT, you can't send it. In the implementation I have setup, it uses a named principal on the named credential and is set to send a token in the header. That header is a bearer token obtained from the auth endpoint. The odata service then verifies the bearer token with the auth service (and gets the JWT in response to that check, rather than receiving the JWT from Salesforce) Commented Dec 2, 2021 at 18:58
  • @Dan can you share some lights here with examples Commented Dec 3, 2021 at 16:36

1 Answer 1

Reset to default
0

Consider your odata service to be the "Resource Server" (RS) and Salesforce to be the "Resource Client" (RC). You will have configured your (Salesforce) auth provider with the details of the "Authorization Server" (AS).

When the named credential is configured with the auth provider, and then the named credential is utilised (either via your own apex code, or via Salesforce internals that are converting the data requests into OData requests against your external data source), Salesforce authenticates with the supplied credentials and (makes a POST) to the AS. In the (successful) response, it gets an access token (AT) (amongst other things).

If you check the option on the named credential to "Generate Authorization Header", that AT retrieved from the AS will be sent as a header with the request.

Authorization: Bearer {access_token}

The RS (your odata service) will receive that that header, and is required to validate the token. (i.e. check that the request is authorised)

This question addresses the same subject. One of the answers states:

the interface between Resource Server and Authorization Server for token validation was standardized in IETF RFC 7662 in October 2015

and links to this spec

Essentially, your odata service will receive a bearer token, and needs to use it to request a JWT from the authorisation server. The JWT will supply the relevant assertions: Issuer, audience etc. that your odata service can check to see if it is happy to serve the response.

Improve this answer
13
  • Yes Named Credentials are set up in My ORG and i can see that it is sending Bearer token Here is an example of bearer token "PAQABAAAAAAD--DLA3VO7QrddgJg7Wevr0lE_OqTIEE2rPAmWX7cDsepIPKJkAOgIdCfC2vfbugqbHQYmz9jJDOv8u5ENonq5uC8oUOKs_86DF9fmUYzATM__3hZnQNgqNDBZ58Qp7F5k4QBfAxAdsY" In my .NetCore Odata 4 controller i need to validate this . as this is not the JWT token how can i even validate this token ? Sorry for asking these basic question, but i am stuck here in this for long. Thanks for your help in advance . Commented Dec 9, 2021 at 22:24
  • Look at the auth. provider record linked to your named credential. What type is it? OpenId, Microsoft Access Control Services, LinkedIn, Google, Salesforce, GitHub? What is the authorise endpoint? (don't share the key or secret here). Once you have these, you can lookup the documentation for that auth. provider which should indicate how you verify the bearer token. Typically, this would be a GET on a similar URL to the authorise endpoint which returns the JWT (or some other structure with relevant details) Commented Dec 10, 2021 at 9:11
  • Yes its openId connect ,but i dont see any documentation where i can get JWT from above token . Commented Dec 10, 2021 at 10:09
  • What is the authorisation endpoint? Commented Dec 10, 2021 at 12:19
  • login.windows.net/common/oauth2/authorize Commented Dec 12, 2021 at 13:22

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.