function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
David C 6David C 6 

Community User Authentication using username and password can be done using REST API

Hi All,

Can anyone please let me know how Salesforce Community User Authentication using username and password can be done using REST API?
thisisnotaprilthisisnotapril
A quick Google search turns up several posts about this:

https://developer.salesforce.com/docs/atlas.en-us.chatterapi.meta/chatterapi/quickstart_communities.htm
https://developer.salesforce.com/blogs/developer-relations/2013/02/oauth-for-portal-users.html
http://salesforce.stackexchange.com/questions/67307/use-rest-api-to-authenticate-my-customer-community-user-login-or-bypass-mobile
Er. Prashant Veer SinghEr. Prashant Veer Singh
In Spring'13 the ability to login these user types via OAuth 2 was added enabling them to be used for the REST APIs as well as the SOAP API. The following document explains:

https://developer.salesforce.com/blogs/developer-relations/2013/02/oauth-for-portal-users

OAuth contains a flow called the username/password flow (see the documentation here (https://help.salesforce.com/HTViewHelpDoc?id=remoteaccess_oauth_username_password_flow.htm&language=en_US)) where you can simply provide the credentials in code to authenticate and then retrieve the access token. 
This is not the preferred method of using OAuth though and you should take great care in storing usernames and passwords (it is better to use another flow which requires a one time login rather than using this flow where data is stored).
OAuth username/password flow also required "Security token". User need to add "security token" to password. But for customer portal users we cannot get "Security token".
You should only require the token on an untrusted network. As you are in control of where the API call roginates from and therefore should manage that IP you can whitelist it.

If not then I am afraid the answer will be no.