function readOnly(count){ }
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
+ Start a Discussion
Kam.ax1015Kam.ax1015 

Calling REST APIs from third party Java web site

Hello,

 

I have to expose products and chatter feed of products on public web site written in Java. How would the oAuth work? Obviously people around the world are not going to login to Salesforce to get authentication token. In other word how would my server to salesforce authentication work with out rediecting to Salesforce visually. Sorry I know very little about oAuth.

 

 

Thanks,

Kam



Best Answer chosen by Admin (Salesforce Developers) 
ChrisOctagonChrisOctagon

You could just log in once as the proxy user and save the access token and copy it into your app.

 

Or you could add an "admin login" page which you use to log the proxy user in which results in the access token being stored in a config file or db. Then the regular pages could access this config to get the access token without having to log people in.

All Answers

LoganLogan

Kam,

 

Good question.  We have a demo app that does exactly that.  See http://chatter-sales.heroku.com for the demo, and https://github.com/henriquez/chatter-sales for the code.  Look at the files under app/controllers and app/models

 

The general idea is that you create a user in the salesforce org that proxies the interaction between un-authenticated users and the salesforce org.  This has nothing to do with Oauth - Oauth is just a way to acquire an access token.  When pulling information out of Salesforce, the web app performs API calls as this proxy user.  When an unauthenticated user posts to a feed, the proxy user posts on their behalf.  Since the web app doesn't know who the user is, they're asked to input their name, but you could imagine using Oauth to get an existing identity from another provider like Facebook, Google, SSO etc. 

Kam.ax1015Kam.ax1015

Although I am not familier with Ruby, let me try to understand the code.

 

Either way proxy user will need to be authenticated right? If so is it not OAut?

 

Thanks a lot.

Kam

ChrisOctagonChrisOctagon

Hi Kam,

 

The user will login using OAuth at some point. I believe this sample code makes use of an access token retrieved from a successful OAuth login.

Kam.ax1015Kam.ax1015

Thanks Chris.

 

I have samples to authenticate using oAuth but that redirects the user to salesforce to get access token. I really need info on how to do it from Java based public web site (similar to what Ruby code is doing).

 

 

ChrisOctagonChrisOctagon

You could just log in once as the proxy user and save the access token and copy it into your app.

 

Or you could add an "admin login" page which you use to log the proxy user in which results in the access token being stored in a config file or db. Then the regular pages could access this config to get the access token without having to log people in.

This was selected as the best answer
Kam.ax1015Kam.ax1015

That sounds like a solution. As long as acess token does not expire.

 

Thanks a lot.

 

 

ChrisOctagonChrisOctagon

Cool. We had a similar discussion on another thread: http://boards.developerforce.com/t5/REST-API-Integration/Chatter-REST-API-with-java-web-aplication/td-p/299493

 

If your access token expires you can get a new one using the refresh token, without any user interaction: https://login.salesforce.com/help/doc/en/remoteaccess_oauth_refresh_token_flow.htm

 

 

Kam.ax1015Kam.ax1015

That's perfect. I guess https://na3.salesforce.com/help/doc/en/remoteaccess_oauth_username_password_flow.htm

will be easiest to implement.

 

Appreciate your prompt help.

 

Thanks,

Kam

 

 

 

LoganLogan

You should not use the username/password flow - the web server flow is the one to use for this type of application.  

Kam.ax1015Kam.ax1015

I agree that would be more secure.

 

Thanks