CIS14: OAuth and OpenID Connect in Action
1 like618 views
The document outlines the steps for implementing OAuth and OpenID Connect with Salesforce Identity, highlighting client registration, metadata retrieval, client initialization, and token usage. It also covers the use of social sign-on and just-in-time provisioning for improved federation, along with advanced features like enterprise policies and two-factor authentication. Additionally, it emphasizes the importance of refresh tokens for single sign-on (SSO) capabilities.
![2) Get your Metadata
{
"issuer": "https://login.salesforce.com",
"authorization_endpoint": "https://login.salesforce.com/services/oauth2/authorize",
"token_endpoint": "https://login.salesforce.com/services/oauth2/token",
"revocation_endpoint": "https://login.salesforce.com/services/oauth2/revoke",
"userinfo_endpoint": "https://login.salesforce.com/services/oauth2/userinfo",
"jwks_uri": "https://login.salesforce.com/id/keys",
"scopes_supported": ["id", "api", "web", "full", "chatter_api", "visualforce", "refresh_token", "openid"],
"response_types_supported": ["code", "token", "token id_token"],
"subject_types_supported": ["public"],
"id_token_signing_alg_values_supported": ["RS256"],
"display_values_supported": ["page", "popup", "touch"],
"token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt"]
}](https://image.slidesharecdn.com/cis2014-oauthandopenidconnectinaction-140805231759-phpapp01/85/CIS14-OAuth-and-OpenID-Connect-in-Action-8-320.jpg)
CIS14: OAuth and OpenID Connect in Action
- 1. OAuth & OpenID Connect in Action Chuck Mortimore VP, Product Management Salesforce Identity @cmort
- 2. a quick demo client
- 4. the world’s simplest client
- 5. 1) Register an App 2) Get your Metadata 3) Create (initialize) your Client 4) Use your Tokens
- 6. 1) Register an App
- 7. 2) Get your Metadata https://login.salesforce.com/.well-known/openid-configuration
- 8. 2) Get your Metadata { "issuer": "https://login.salesforce.com", "authorization_endpoint": "https://login.salesforce.com/services/oauth2/authorize", "token_endpoint": "https://login.salesforce.com/services/oauth2/token", "revocation_endpoint": "https://login.salesforce.com/services/oauth2/revoke", "userinfo_endpoint": "https://login.salesforce.com/services/oauth2/userinfo", "jwks_uri": "https://login.salesforce.com/id/keys", "scopes_supported": ["id", "api", "web", "full", "chatter_api", "visualforce", "refresh_token", "openid"], "response_types_supported": ["code", "token", "token id_token"], "subject_types_supported": ["public"], "id_token_signing_alg_values_supported": ["RS256"], "display_values_supported": ["page", "popup", "touch"], "token_endpoint_auth_methods_supported": ["client_secret_post", "private_key_jwt"] }
- 9. 3) Create your Client https://login.salesforce.com/services/oauth2/authorize? response_type=code&redirect_uri=https%3A%2F %2Flocalhost&client_id=… curl -H 'Content-Type: application/x-www-form-urlencoded' -d "client_id=...&client_secret=...&redirect_uri=https%3A%2F %2Flocalhost&grant_type=authorization_code&code=..." https:// login.salesforce.com/services/oauth2/token …and validate your id_token
- 10. 4) Use your access_token curl -H "Authorization: Bearer ..." https://login.salesforce.com/ services/oauth2/userprofile
- 12. so what can we do with all this plumbing?
- 13. social sign-on
- 14. 1) Register an App
- 15. 2) Get your Metadata https://accounts.google.com/.well-known/openid-configuration
- 16. 3) Initialize your client software
- 18. faster, simpler, better federation
- 19. 1) Register an App
- 20. 2) Get your Metadata https://gold.pinglabs.net:9031/.well-known/openid-configuration
- 21. 3) Initialize your client software
- 22. 4) Map Users
- 23. 5) Access APIs!
- 25. Let’s build this App
- 26. Refresh Tokens provide “SSO”
- 27. Let’s Layer in Federation
- 28. Let’s add Enterprise Policies
- 29. How about Two Factor Authentication