Problem/Motivation

The Salesforce Gov Cloud requires to have a token url different to login url, but right now JWT auth plugin only supports login url.

Proposed resolution

Add a new JWT Auth plugin for Gov Cloud.

Comments

jidrone created an issue. See original summary.

jidrone’s picture

Status: Active » Needs review
StatusFileSize
new4.6 KB

Here is the patch.

aaronbauman’s picture

This article suggests that the login and token urls don't necessarily need to be different: https://help.salesforce.com/articleView?id=000229902&type=1

Only that they need to not be login.salesforce or test.salesforce

Can you test by switching the login URL only?

aaronbauman’s picture

Status: Needs review » Needs work
lostkangaroo’s picture

Status: Needs work » Reviewed & tested by the community

I am able to confirm that this is indeed an issue with Gov Cloud. While I don't believe a new plugin and consumer is needed, there does need to be a separation of the login URL being used as both the login endpoint and the audience field as is the case in the existing JWT implementation. This would be simpler to add the token URL as an optional form field and default to the login URL if not provided as would be the case for 99% of users.

As for the concern in #3, the article was updated on Jul 21, 2020, to reflect that users are not able to use login.salesforce.com or test.salesforce.com for login URLs. They are however needed as audience fields for the JWT token itself.

I have tested the above patch and it indeed does the job of allowing connections to Gov Cloud instances.

aaronbauman’s picture

Version: 8.x-4.x-dev » 5.0.x-dev
Status: Reviewed & tested by the community » Fixed

Great, committed to 5.x and 4.x.
Thanks for your patches and patience

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.