Glen Mazza's Weblog

https://glenmazza.net/blog/date/20210404 Sunday April 04, 2021

Accessing Salesforce using Spring Security 5's OAuth2 client

For the two Salesforce OAuth2 flows discussed in my earlier blog post, namely the JWT bearer token and username/password flows, I've created a sample Spring Boot app on Github. This app will obtain access tokens using the flow you configure and make a sample call to Salesforce's standard "Account" resource. Note both these server-to-server flows assume a hardcoded single resource owner for all API calls. (For clients handling multiple users logging in and authorizing calls, Salesforce's Web Server Flow is more appropriate, there are some links at the bottom for information on this flow.)

To run the sample, first create an application.properties file in the resources folder with the configuration necessary for the flow you are using (there is a template file in that folder specifying what is needed for each flow type, with the earlier blog post providing instructions on how to obtain these values). The sample's SalesforceOAuth2Config class reads that configuration, and will halt on startup with informational messages if anything needed is missing. The app can be run from an IDE like IntelliJ or command-line via gradle bootRun, and it will make a sample call retrieving one Salesforce Account object every 30 seconds until halted.

To create the app, I used Spring's Initialzr with the latest Spring Boot release version and Java 11, and added the Spring Web, Spring Reactive Web, and OAuth2 Client dependencies. During development I also brought in a few extra libraries listed in the build.gradle. The Username/Password flow is supported out of the box by Spring, but the JWT bearer token flow requires some extra classes that I implemented following Spring's source code for their standard password and client grant flows. The files are commented to aid in understanding this flow:

What happens when access tokens expire? The WebClient call in SalesforceService has a retry(1) setting that allows one additional call to the resource server in case of an error such as using an expired access token. In such cases, for the first call, the failure handler in SalesforceOAuth2Config removes the authorized client instance (which has the invalid access token) from memory. For the retry call, SalesforceJwtBearerOAuth2AuthorizedClientProvider notes that there is not an authorized client instance anymore so proceeds to obtain a new access token to allow the second call to proceed. This functionality can be verified by revoking the access token from either Salesforce Setup's Session Management screen or from Connected Apps usage, and making a subsequent resource API call, it should seamlessly provide the data. Code breakpoints can also be used to confirm another access token was requested.

Additional Resources

Posted by Glen Mazza in Programming at 07:00AM Apr 04, 2021 | Tags:  oauth2  salesforce  spring | Comments[0]


Calendar
« April 2021
Sun Mon Tue Wed Thu Fri Sat
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Today
About Me
Java Software Engineer
TightBlog project maintainer
Arlington, Virginia USA
glen.mazza at pm dot me
GitHub profile for Glen Mazza at Stack Overflow, Q&A for professional and enthusiast programmers
Blog Search


Blog article index
Navigation
About Blog
Blog software: TightBlog 3.7.2
Application Server: Tomcat
Database: MySQL
Hosted on: Linode
SSL Certificate: Let's Encrypt
Installation Instructions