function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
benvkbenvk 

OAuth Prompt user to login to solve multiple active salesforce sessions

Hi,

 

How can I force a user logging in with OAuth to be prompted for login instead of automatically authorizing the user. The problem comes when a user has multiple active browser sessions and has already 'allowed' the app previously to access the site.

 

If I'm logged into my dev org and pr

I'm using the web server authentication flow - using the following URL:

https://login.salesforce.com/services/oauth2/authorize?response_type=code&client_id=xxx&redirect_uri=http://xxxx&display=full&immediate=false&state=xxx

 

* I've tried using immediate=false, but that makes no difference once the user has 'allowed' the app access.

* I've tried using https://login.salesforce.com/setup/secur/RemoteAccessAuthorizationPage.apexp instead of the normal https://login.salesforce.com/services/oauth2/token - this does force a prompt but then it gives me an 1800 error, whatever that is - i think that URL is for OAuth 1.0 (??).

 

Aside from being difficult when developing (since I'm logged into 1 org, and want to authenticate against another org), I think users will get confused if they are automatically logged into an org, even if they have previously allowed the app through. Also, it seems kind of random which org the user is logged into, which I wonder if this is a bug or by design?

 

Thanks

 

p.s. i love that the spell checker suggests 'salesrooms' for salesforce!

 

Ben

benvkbenvk

Bump...

 

Afraid I still haven't found any solutions for this. Anyone?

 

thanks

 

ben
Mandeep SinghMandeep Singh

Bump!

I am hitting the same situation :(

I am trying to login from diffrent orgs and storing the access tokens received, so i can switch the user in my app, to obtain data for different org.

 

p.s. sorry Ben if you received a notification, and got excited thinking you received an *actual* reply!

 
benvkbenvk

Actually, this problem seems to be fixed now. See http://help.salesforce.com/help/doc/en/remoteaccess_oauth_web_server_flow.htm, I believe this is a new feature and didn't exist when I asked this question.

 

prompt—Specifies how the authorization server prompts the user for reauthentication and reapproval. This parameter is optional. The only values Salesforce supports are:

  • login—The authorization server must prompt the user for reauthentication, forcing the user to log in again.
  • consent—The authorization server must prompt the user for reapproval before returning information to the client.

It is valid to pass both values, separated by a space, to require the user to both log in and reauthorize. For example:

?prompt=login%20consent
Mandeep SinghMandeep Singh

Cool!

Thanks Ben.

I will give it a shot right away!