Notes on SFDC OAuth2 Flows

6 flows

1. SAML Bearer Assertion Flow

Token endpoint: POST: https://login|test.salesforce.com/services/oauth2/token

grant_type=urnparamsgrant-type:saml2-bearer

assertion=The SAML Bearer Assertion, encoded using base64url.

response: access_token

1. JWT Bearer Token Flow

Token endpoint: POST: https://login|test.salesforce.com/services/oauth2/token

POST: JWT

response: access_token

1. Web Server Flow

Verification endpoint: GET :https://login|test.salesforce.com/services/oauth2/authorize

response_type=code (Validation Code)

Exchange Validation Code for access_token:

Token endpoint: POST: https://login|test.salesforce.com/services/oauth2/token

grant_type=authorization_code

response: access_token

1. User-Agent OAuth Authentication Flow

Authorize endpoint: https://login|test.salesforce.com/services/oauth2/authorize

response_type=token

1. Web SSO SAML Assertion

Do not have to create a connected app to use this assertion flow

Token endpoint: https://login|test.salesforce.com/services/oauth2/token

grant_type=assertion

assertion_type=urnnamesSAML:2.0SSO:browser

assertion=The SAML Assertion, encoded using base64

Reference

1. Username and Password Flow

Token endpoint: https://login|test.salesforce.com/services/oauth2/token

grant_type=password

username=username

password=user_password

Reference:

• Digging Deeper into OAuth 2.0 on Force.com