OAuth2.0An overview of OAuth2.0 on Force.com projectsJune 11th 2015

Aldo Fernandez Technical Consultant

@aldoforce

Safe Harbor

Safe harbor statement under the Private Securities Litigation Reform Act of 1995: This presentation may contain forward-looking statements that involve risks, uncertainties, and assumptions. If any such uncertainties materialize or if any of the assumptions proves incorrect, the results of salesforce.com, inc. could differ materially from the results expressed or implied by the forward-looking statements we make. All statements other than statements of historical fact could be deemed forward-looking, including any projections of subscriber growth, earnings, revenues, or other financial items and any statements regarding strategies or plans of management for future operations, statements of belief, any statements concerning new, planned, or upgraded services or technology developments and customer contracts or use of our services.

The risks and uncertainties referred to above include – but are not limited to – risks associated with developing and delivering new functionality for our service, our new business model, our past operating losses, possible fluctuations in our operating results and rate of growth, interruptions or delays in our Web hosting, breach of our security measures, risks associated with possible mergers and acquisitions, the immature market in which we operate, our relatively limited operating history, our ability to expand, retain, and motivate our employees and manage our growth, new releases of our service and successful customer deployment, our limited history reselling non-salesforce.com products, and utilization and selling to larger enterprise customers. Further information on potential factors that could affect the financial results of salesforce.com, inc. is included in our annual report on Form 10-K for the most recent fiscal quarter ended July 31, 2011. This document and others are available on the SEC Filings section of the Investor Information section of our Web site.

Any unreleased services or features referenced in this or other press releases or public statements are not currently available and may not be delivered on time or at all. Customers who purchase our services should make the purchase decisions based upon features that are currently available. Salesforce.com, inc. assumes no obligation and does not intend to update these forward-looking statements.

Follow UYSDUG for the latest news

@uysdug #uysdug

/Uruguay-Salesforce-Developer-User-Group/

www.uysdug.com

Join us and share your knowledge!▪ Got something to share with the world?▪ We are open for talks/sessions▪ Check www.uysdug.com/cfp or get in contact with

someone from the Technical Board for more information

▪ UPCOMING EVENTS:▪ July (Trailhead week)▪ August (New Summer15 APIs)*▪ September (Dreamforce 15!)

Agenda

▪ What is OAuth2.0?▪ OAuth roles from Force.com perspective▪ Connected apps as a gateway▪ Authentication flows▪ Tokens, tokens… tokens everywhere▪ Step by step flows

What is OAuth 2.0? (formal)

▪ Is the evolution of OAuth protocol originally created in 2006▪ “OAuth2.0 focuses on client developer simplicity while providing

specific authorization flows for web, desktop and mobile applications and living room devices” — oauth.net/2

▪ If feeling brave, check the final version of the spec at: http://tools.ietf.org/html/rfc6749

What is OAuth 2.0? (for the common people)

▪ OAuth2 is an authorization framework that enables applications to obtain limited access to user accounts on an HTTP service

▪ It works by delegating user authentication to the service that hosts the user account and authorizing 3rd party apps to access the user account

▪ It provides authorization flows for web/desktop apps and mobile devices

▪ The “valet key for the web”

OAuth roles from Force.com perspective

▪ Resource owner (Salesforce User)▪ Client (an external app trying to do some cool stuff with Salesforce)▪ Resource server (the salesforce instance na1.salesforce.com)▪ Authorization server (the salesforce login hub login.salesforce.com)

OAuth roles from Force.com perspective

Connected Apps as a gateway

▪ Previously known a “remote access apps”▪ Is an application that integrates with Salesforce using APIs such

REST and SOAP.▪ Provides standard OAuth capabilities▪ Allow administrators to set security policies and have explicit control

over who may use the app▪ Package and deploy friendly (hello ISVs!)▪ It’s the Salesforce’s abstraction of your external apps

Connected Apps

▪ When creating, you define OAuth metadata like:▪ Basic descriptive and contact information for the app▪ OAuth scopes and callback URL▪ IP ranges where the app might be running (optional)▪ Information about mobile policies (optional)

▪ In return you will receive:▪ A client id (consumer key)▪ A client secret (consumer secret)▪ You will need BOTH for almost all authentication flows!

Connected Apps

Scopes

▪ API: allows access to the curent logged in user’s account over the Salesforce APIs (includes chatter API)

▪ CHATTER_API: allows acces to Chatter API only▪ FULL: allows access to all data accessible by current user. Doesn’t

include refresh_token▪ REFRESH_TOKEN: allows to return a refresh token for logged in user.▪ VISUALFORCE: allows access to Visualforce pages▪ WEB: allows the ability to use access_token on the Web (includes

Visualforce scope)

A HA moment!

Callback URL

▪ AKA ‘redirect URI’▪ Is an endpoint(*) in your application to which Force.com can redirect

the user’s browser with an authentication code or access token▪ To protect the tokens transactions HTTPS is enforced. HTTP only

allowed to localhost▪ The redirect is a browser redirect

OAuth flows

▪ Web Server *▪ User Agent *▪ JWT (JSON Web Token)▪ SAML Bearer assertion▪ SAML assertion▪ Username and password *▪ Token refresh *

* most used/popular

Tokens, tokens… tokens everywhere!

▪ Authorization code: short lived token created by the authorization server and passed to the client app via browser. The client app sends the authorization code to the authorization server to obtain an access token or refresh token.

▪ Access token: used by the client app to make authenticated requests on behalf of the end user. Lifetime on the order of minutes/hours, then a new access token must be obtained.

▪ Refresh token: unlimited lifetime or until explicitly revoked by end-user. The client app can store the refresh token to periodically obtain fresh access tokens. MUST PROTECT AS A PASSWORD

▪ ID token: Used and defined by OpenID Connect. Provides information about the logged in user.

Web Server flow

Web Server flow (step by step)

User Agent flow

Username and password flow

Token refresh

Resources + Kudos

▪ Pat Patterson @metadaddy “Digging Deeper into OAuth 2.0 on Force.com”

▪ Pat Patterson @metadaddy “Getting started with Force.com REST API” @salesforcedocs

▪ OAuth community site (oauth.net)

Thank You!

OAuth2.0An overview of OAuth2.0 on Force.com projects

UruguaySalesforce Developer Group

June 11, 2015 #UYSDUG

Aldo FernandezTechnical Consultant

@aldoforce

#uysdug#oauth