How to Authenticate user using Username-Password Authentication Flow in Salesforce?<\/strong><\/p>\n

Salesforce uses oAuth protocol to allow application users to access the data in salesforce securely without exposing Username and password of a particular user.<\/p>\n

But before we could make a REST Api call, we need to authenticate our app with salesforce, by making it a connected app. To make an App as connected app follow the steps given in this post.<\/p>\n

<\/p>\n

There are several OAuth endpoints provided by Salesforce, depending upon our requirement and resources we need to choose an authentication flow from the below<\/p>\n

\n
1. Web server Flow<\/strong><\/li>\n
2. User-Agent Flow<\/strong><\/li>\n
3. Username-Password Flow<\/strong><\/li>\n<\/ol>\n

   Once we have successfully authenticated our connected app user, salesforce provide us with an access token, which are further utilised to make authenticated REST Api calls.<\/p>\n

   In this post we are going to discuss the Username-Password Authentication Flow<\/strong>.<\/p>\n

   This authentication flow make use of user\u2019s credentials directly on the web server and should be used only if necessary, there is no refresh token is provided in this flow, see the flow diagram below.<\/p>\n

   <\/p>\n

   Step wise breakdown of the authentication flow:<\/p>\n

   \n
   1. The application uses the credential of the user to generate the access token. To use this service, we make a POSt call to the endpoint for the Username-password authentication flow : https:\/\/login.salesforce.com\/services\/oauth2\/token<\/li>\n<\/ol>\n

      Parameter\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Description<\/p>\n

      grant_type\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Must be password for this authentication flow.<\/p>\n

      client_id\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The Consumer Key from the connected app definition.<\/p>\n

      client_secret\u00a0\u00a0\u00a0\u00a0\u00a0 The Consumer Secret from the connected app definition. Required unless the Require Secret for Web Server Flow setting is not enabled in the connected app definition.<\/p>\n

      username\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 End-user\u2019s username.<\/p>\n

      password\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 End-user\u2019s password.<\/p>\n

      Example authorization url will look something like this:<\/p>\n

      grant_type=password&client_id=3MVG9lKcPoNINVBIPJjdw1J9LLM82HnFVVX19KY1uA5mu0QqEWhqKpoW3svG3XHrXDiCQjK1mdgAvhCscA9GE&client_secret=1955279925675241571&username=testuser%40salesforce.com&password=mypassword123456<\/p>\n

      \n
      1. After confirmation from Salesforce the client application will get a response with the access token authorized and end-user\u2019s Web browser would be redirected to the callback URL specified by the\u00a0redirect_uri\u00a0parameter. The authorization information is appended by Salesforce to the redirect URL with the following values:<\/li>\n<\/ol>\n

         Parameters\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Description<\/p>\n

         access_token\u00a0\u00a0\u00a0 Access token that acts as a session ID that the application uses for making requests. This token should be protected as though it were user credentials.<\/p>\n

         instance_url\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Identifies the Salesforce instance to which API calls should be sent.<\/p>\n

         id\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Identity URL that can be used to both identify the user as well as query for more information about the user. Can be used in an HTTP request to get more information about the end user.<\/p>\n

         issued_at\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 When the signature was created, represented as the number of seconds since the Unix epoch (00:00:00 UTC on 1 January 1970).<\/p>\n

         signature\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Base64-encoded HMAC-SHA256 signature signed with the consumer’s private key containing the concatenated ID and issued_at value. The signature can be used to verify that the identity URL wasn\u2019t modified because it was sent by the server.<\/p>\n

         An example of the response is as shown below<\/p>\n

         {“id”:”https:\/\/login.salesforce.com\/id\/00Dx0000000BV7z\/005x00000012Q9P”,<\/p>\n

         “issued_at”:”1278448832702″,”instance_url”:”https:\/\/***yourInstance***.salesforce.com\/”,<\/p>\n

         “signature”:”0CmxinZir53Yex7nE0TD+zMpvIWYGb\/bdJh6XfOH6EQ=”,”access_token”:<\/p>\n

         “00Dx0000000BV7z!AR8AQAxo9UfVkh8AlV0Gomt9Czx9LjHnSSpwBMmbRcgKFmxOtvxjTrKW1<\/p>\n

         9ye6PE3Ds1eQz3z8jr3W7_VbWmEu4Q8TVGSTHxs”}<\/p>\n

         \n
         1. The information received in the previous step is further used to make the authenticated REST Api calls.<\/li>\n<\/ol>\n
            \n
            • Keep following point in mind when using username-password flow. User is not redirected to Salesforce Login screen and is therefore not able to authorize the external application and therefore no refresh token is granted to the end user. Need to Use other OAuth Flow if a refresh token is required.<\/li>\n<\/ul>\n

              Also, Have a look at the below resources:<\/strong><\/h1>\n

              \n
              1. \n

                 Best Salesforce Interview Questions book with Apex and Visualforce concept explained<\/a><\/h3>\n<\/li>\n<\/ol>\n

                 Also, Have a look at the below learning resources:<\/strong><\/h1>\n

                 \n
                 1. \n

                    SOQL (Salesforce Object Query Language)<\/a><\/strong><\/em><\/h3>\n<\/li>\n

                    \n

                    Apex Trigger Best Practices and the Trigger Framework<\/a><\/strong><\/em><\/h3>\n<\/li>\n

                    \n

                    Salesforce Interview Question and Answers Part 2<\/a><\/strong><\/em><\/h3>\n<\/li>\n

                    \n

                    Salesforce Interview Questions on Test Class<\/a><\/strong><\/em><\/h3>\n<\/li>\n

                    \n

                    Salesforce-lightning-interview-questions-2018<\/cite><\/span><\/a><\/strong><\/em><\/h3>\n<\/li>\n<\/ol>\n

                    \u00a0 \u00a0 \u00a06.\u00a0Salesforce Interview Questions Batch Class\u00a0<\/a><\/strong><\/em><\/h3>\n","protected":false},"excerpt":{"rendered":"

                    How to Authenticate user using Username-Password Authentication Flow in Salesforce? Salesforce uses oAuth protocol to allow application users to access the data in salesforce securely without exposing Username and password of a particular user. But before we could make a REST Api call, we need to authenticate our app with salesforce, by making it a …
                    Continue reading How to Authenticate user using Username-Password Authentication Flow in Salesforce?<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":1272,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[178],"tags":[240,218,232,231,236,238,234,235,237,213,233,224,221,214,215,229,217,226,220,219,222,230,225,223,228,239],"_links":{"self":[{"href":"https:\/\/salesforcenextgen.com\/wp-json\/wp\/v2\/posts\/1271"}],"collection":[{"href":"https:\/\/salesforcenextgen.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/salesforcenextgen.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/salesforcenextgen.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/salesforcenextgen.com\/wp-json\/wp\/v2\/comments?post=1271"}],"version-history":[{"count":2,"href":"https:\/\/salesforcenextgen.com\/wp-json\/wp\/v2\/posts\/1271\/revisions"}],"predecessor-version":[{"id":2182,"href":"https:\/\/salesforcenextgen.com\/wp-json\/wp\/v2\/posts\/1271\/revisions\/2182"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/salesforcenextgen.com\/wp-json\/wp\/v2\/media\/1272"}],"wp:attachment":[{"href":"https:\/\/salesforcenextgen.com\/wp-json\/wp\/v2\/media?parent=1271"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/salesforcenextgen.com\/wp-json\/wp\/v2\/categories?post=1271"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/salesforcenextgen.com\/wp-json\/wp\/v2\/tags?post=1271"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}