For some reason the REST client uses a hardcoded OAuth authorization type instead of Bearer (link ). This results connection errors like below (also see the the attached screenshot).
Error when connecting to Salesforce. Please check your credentials and try again: Client error: `GET [HOST]/services/data/v52.0/sobjects` resulted in a `401 Unauthorized` response: [{"message":"Session expired or invalid","errorCode":"INVALID_SESSION_ID"}] [{"message":"Session expired or invalid","errorCode":"INVALID_SESSION_ID"}]
After some investigation and research it's still not entirely clear to me why OAuth is used instead of Bearer because:
1. Bearer is the standard value.
2. Even the official documentation says it should be Bearer: OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration.
My assumption is that OAuth is a legacy type and it is kept for backwards compatibility for older APIs but it's not clear to me exactly where and in what situations.
I'm not sure how this could be reproduced consistently because a couple of months ago I managed to connect to the Salesforce organization without any issues, but now I'm having a problem with another one. I can also imagine that this can be related to some organization specific authorization settings, but that's very unlikely.
Fix the REST client to use Bearer instead of OAuth in the Authorization header.
N/A
N/A
N/A
| Comment | File | Size | Author |
|---|---|---|---|
| connection-error-due-to-oauth-authorization-header.png | 181.55 KB | balazswmann |
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #2
balazswmann commentedComment #4
balazswmann commentedComment #5
aaronbaumanOAuth JWT is a different module altogether.
The doc you want is user-agent flow.
https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_u...
The recommended method is OAuth JWT, and setup is described here: https://www.drupal.org/docs/contributed-modules/salesforce-suite/create-...
and here: https://www.drupal.org/docs/contributed-modules/salesforce-suite/set-up-...
That's provided through salesforce_jwt sub-module
salesforce_oauth module is not really supported or recommended any more, so I'm hesitant to make further updates.
Comment #6
balazswmann commentedI'm not using the
salesforce_oauthmodule, I'm usingsalesforce_jwt. The very first link in the module's Create a OAuth JWT Bearer Token flow connected app document is the same official documentation what I linked in the issue description and it says thatBearershould be used in the Authorization header.And the problem is not in the submodules but in the
salesforcecore module's RestClient as I also linked it in the issue description.Comment #7
aaronbaumanHuh, yeah, i see that now.
Weird that it's working at all then, unless like you suggest it's legacy support.
Seems straightforward enough.
Comment #8
balazswmann commentedI think the best would be to double check this with Salesforce support to ensure that this change not going to break connection for someone.
Comment #9
balazswmann commentedSince then I realized that the Authorization header also need to be fixed in
Drupal\salesforce\SalesforceAuthProviderPluginBasenot just inDrupal\salesforce\Rest\RestClientso I pushed a new commit to fix that.Comment #10
balazswmann commentedI still think that Salesforce support should verify that these changes are correct to ensure that they not going to break the connection for someone once this fix gets merged. My assumption that "OAuth" is a legacy value is still just an assumption, I haven't verified it with Salesforce.
Comment #11
balazswmann commentedComment #12
aaronbaumanConfirmed with Salesforce support and merged.
Thank you for your work.