function readOnly(count){ }
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
+ Start a Discussion
RossKRossK 

Secure Access of Visualforce Pages from a third party Website

Hi,
I need a little assistance on the following situation

1) We have a business partner who has a secure portal (not salesforce) accessed by their customers.
2) We want the business partner's portal user to be able to access a secure Visualforce page that displays fields from a custom object.

I think the approach to this is as follows:
Business Partner's Portal would contain a button that looks like this    businesspartnerdomain/privatepage?customernumber=xyz&mode=edit&object=contact

The "privatepage" referred to above handles authentication and forwards the user to the secure Visualforce page with the customer information displayed. The customer should never know that they left the business partners website.

We are planning to use Communities liscenses where we pay for each login.   

I have read the following documents.
1) Using oauth with VF: https://developer.salesforce.com/blogs/developer-relations/2011/09/using-oauth-2-0-with-visualforce-in-winter-12.html
2) oauth SF Documentation/Setuphttps://developer.salesforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com
3) Code: Sample/Package  https://www.npmjs.com/package/salesforce-oauth2 


What is the preferred approach to doing this?

Is it  using OAuth2.0, an API Key, rather than username/pwd/token?  Is this do-able?  What would the reccommended o-auth flow be (Web-Server)? It is critical is that I do not want to have any login or confirmation window pop-up when the user views our secure vf page.  

Thank you so much for your help!




 
James LoghryJames Loghry
In general, connected apps and oauth are meant for API access and not displaying visualforce pages.  One option you could look into is hosting the page on a partner community, and only allowing access to an integration user's profile. The downside here is you would need to have the user enter some credentials in a pop up window or implement an SSO solution between the partner's application and Salesforce. Otherwise you could authenticate via oauth again, but bring in the salesforce data via a query and render the HTML on your partner's application if that's feasible.

Maybe someone has a better idea, but that's my .02 worth.