Tell me more ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.
up vote 3 down vote favorite
2

I am working on an AngularJS mobile application that obtains its data from salesforce.com using REST calls to @RestResource Apex classes. (There are no conventional Visualforce/Apex controller pages.) This works fine when the Apex classes are exposed in an unauthenticated manner through a site.

However, the intention is that users (customers) will be able to self-register and that their access will be secured through the User created via Site.createPortalUser. Some testing and Googling suggests that the corresponding Site.login has no affect when invoked from a @RestResource class.

An alternate approach appears to be to make use of the Username-Password OAuth Authentication Flow and I am encouraged about using this for sites by this OAuth for Portal Users blog. But the first link says that the security token must be appended to the password and I don't see how this token can be obtained for a portal user. And if it could it would be very hard for the user to enter. (That difficulty would seem to make it inappropriate for any type of interactive user.)

Has anyone solved this problem of providing username/password (without security token) authentication for users from JavaScript clients of @RestResource services?

share|improve this question
1  
I asked a similar question here (salesforce.stackexchange.com/questions/15470/…) and ended up changing how it works to avoid this issue, very interested to see if you can find a solution. –  Phil B Oct 23 at 19:49
 
I'm spending the day working on another area in the hope that something useful gets posted here but given the similarity of your pretty much unanswered question I'm not optimistic. Might try invoking a Visualforce page behind the scenes and grabbing the session id from the response but that seems very hacky... –  Keith C Oct 24 at 14:31
 
This might be helpful in your case: blogs.developerforce.com/developer-relations/2013/02/… –  Phil B Oct 24 at 15:05
 
Thanks but yeah I already saw that (and have a link to it in the question). –  Keith C Oct 24 at 16:15
 
Authenticating a user outside of white listed domain without appending security token seems like breaking salesforce login security layer. This shouldn't be possible. –  regal Oct 24 at 16:57

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.