This document provides an overview of OAuth2.0 in Force.com projects. It defines the key concepts of OAuth2.0 including the roles, connected apps, scopes, tokens and popular flows. It also outlines the web server, user agent, token refresh and username/password flows in a step-by-step manner. Resources for further reading on OAuth2.0 and the Force.com REST API are provided. The presentation was delivered to the Uruguay Salesforce Developer Group on June 11, 2015.

1. OAuth2.0
An overview of OAuth2.0 on Force.com projects
June 11th 2015

2. Aldo Fernandez
Technical Consultant
@aldoforce

3. Safe Harbor
Safe harbor statement under the Private Securities Litigation Reform Act of 1995: This presentation may contain forward-looking statements that involve
risks, uncertainties, and assumptions. If any such uncertainties materialize or if any of the assumptions proves incorrect, the results of salesforce.com,
inc. could differ materially from the results expressed or implied by the forward-looking statements we make. All statements other than statements of
historical fact could be deemed forward-looking, including any projections of subscriber growth, earnings, revenues, or other financial items and any
statements regarding strategies or plans of management for future operations, statements of belief, any statements concerning new, planned, or
upgraded services or technology developments and customer contracts or use of our services.
The risks and uncertainties referred to above include – but are not limited to – risks associated with developing and delivering new functionality for our
service, our new business model, our past operating losses, possible fluctuations in our operating results and rate of growth, interruptions or delays in
our Web hosting, breach of our security measures, risks associated with possible mergers and acquisitions, the immature market in which we operate,
our relatively limited operating history, our ability to expand, retain, and motivate our employees and manage our growth, new releases of our service and
successful customer deployment, our limited history reselling non-salesforce.com products, and utilization and selling to larger enterprise customers.
Further information on potential factors that could affect the financial results of salesforce.com, inc. is included in our annual report on Form 10-K for the
most recent fiscal quarter ended July 31, 2011. This document and others are available on the SEC Filings section of the Investor Information section of
our Web site.
Any unreleased services or features referenced in this or other press releases or public statements are not currently available and may not be delivered
on time or at all. Customers who purchase our services should make the purchase decisions based upon features that are currently available.
Salesforce.com, inc. assumes no obligation and does not intend to update these forward-looking statements.

4. Follow UYSDUG for the latest news
@uysdug #uysdug
/Uruguay-Salesforce-Developer-User-Group/
www.uysdug.com

5. Join us and share your knowledge!
▪ Got something to share with the world?
▪ We are open for talks/sessions
▪ Check www.uysdug.com/cfp or get in contact with
someone from the Technical Board for more information
▪ UPCOMING EVENTS:
▪ July (Trailhead week)
▪ August (New Summer15 APIs)*
▪ September (Dreamforce 15!)

6. Agenda
▪ What is OAuth2.0?
▪ OAuth roles from Force.com perspective
▪ Connected apps as a gateway
▪ Authentication flows
▪ Tokens, tokens… tokens everywhere
▪ Step by step flows

7. What is OAuth 2.0? (formal)
▪ Is the evolution of OAuth protocol originally created in 2006
▪ “OAuth2.0 focuses on client developer simplicity while providing
specific authorization flows for web, desktop and mobile applications
and living room devices” — oauth.net/2
▪ If feeling brave, check the final version of the spec at: http://
tools.ietf.org/html/rfc6749

8. What is OAuth 2.0? (for the common people)
▪ OAuth2 is an authorization framework that enables applications to
obtain limited access to user accounts on an HTTP service
▪ It works by delegating user authentication to the service that hosts
the user account and authorizing 3rd party apps to access the user
account
▪ It provides authorization flows for web/desktop apps and mobile
devices
▪ The “valet key for the web”

9. OAuth roles from Force.com perspective
▪ Resource owner (Salesforce User)
▪ Client (an external app trying to do some cool stuff with Salesforce)
▪ Resource server (the salesforce instance na1.salesforce.com)
▪ Authorization server (the salesforce login hub login.salesforce.com)

10. OAuth roles from Force.com perspective

11. Connected Apps as a gateway
▪ Previously known a “remote access apps”
▪ Is an application that integrates with Salesforce using APIs such
REST and SOAP.
▪ Provides standard OAuth capabilities
▪ Allow administrators to set security policies and have explicit control
over who may use the app
▪ Package and deploy friendly (hello ISVs!)
▪ It’s the Salesforce’s abstraction of your external apps

12. Connected Apps
▪ When creating, you define OAuth metadata like:
▪ Basic descriptive and contact information for the app
▪ OAuth scopes and callback URL
▪ IP ranges where the app might be running (optional)
▪ Information about mobile policies (optional)
▪ In return you will receive:
▪ A client id (consumer key)
▪ A client secret (consumer secret)
▪ You will need BOTH for almost all authentication flows!

13. Connected Apps

14. Scopes
▪ API: allows access to the curent logged in user’s account over the
Salesforce APIs (includes chatter API)
▪ CHATTER_API: allows acces to Chatter API only
▪ FULL: allows access to all data accessible by current user. Doesn’t
include refresh_token
▪ REFRESH_TOKEN: allows to return a refresh token for logged in user.
▪ VISUALFORCE: allows access to Visualforce pages
▪ WEB: allows the ability to use access_token on the Web (includes
Visualforce scope)

15. A HA
moment!

16. Callback URL
▪ AKA ‘redirect URI’
▪ Is an endpoint(*) in your application to which Force.com can redirect
the user’s browser with an authentication code or access token
▪ To protect the tokens transactions HTTPS is enforced. HTTP only
allowed to localhost
▪ The redirect is a browser redirect

17. OAuth flows
▪ Web Server *
▪ User Agent *
▪ JWT (JSON Web Token)
▪ SAML Bearer assertion
▪ SAML assertion
▪ Username and password *
▪ Token refresh *
* most used/popular

18. Tokens, tokens… tokens everywhere!
▪ Authorization code: short lived token created by the authorization server and
passed to the client app via browser. The client app sends the authorization code to
the authorization server to obtain an access token or refresh token.
▪ Access token: used by the client app to make authenticated requests on behalf of
the end user. Lifetime on the order of minutes/hours, then a new access token
must be obtained.
▪ Refresh token: unlimited lifetime or until explicitly revoked by end-user. The client
app can store the refresh token to periodically obtain fresh access tokens. MUST
PROTECT AS A PASSWORD
▪ ID token: Used and defined by OpenID Connect. Provides information about the
logged in user.

19. Web Server flow

20. Web Server flow (step by step)

21. User Agent flow

22. Username and password flow

23. Token refresh

24. Resources + Kudos
▪ Pat Patterson @metadaddy “Digging Deeper into OAuth
2.0 on Force.com”
▪ Pat Patterson @metadaddy “Getting started with
Force.com REST API” @salesforcedocs
▪ OAuth community site (oauth.net)

25. Thank You!
OAuth2.0
An overview of OAuth2.0 on Force.com projects
Uruguay
Salesforce Developer Group
June 11, 2015 #UYSDUG
Aldo Fernandez
Technical Consultant
@aldoforce
#uysdug
#oauth