search

wadewegner / Force.com-Toolkit-for-NET

The Force.com Toolkits for .NET provides an easy way for .NET developers to interact with the Force.com & Chatter REST APIs using native libraries.
BSD 3-Clause "New" or "Revised" License
374 stars 396 forks source link

JWT Authentication #393

Open JodieM opened 3 years ago

JodieM commented 3 years ago

Please add JWT as an authentication option. This is a great tool for dot net developers, but everyone should be using the best authentication possible to connect to our production Salesforce orgs. Salesforce says JWT is the preferred method for server to server communications so this package should allow it.

claboran commented 3 years ago

@JodieM - We have been thinking about the topic in our projects here. Having large .Net applications running on Heroku and talking to a bunch of sandboxes. So I came up with an own implementation: ForceDotNetJwtCompanion. Recently put it on Nuget and migrated the first of our applications successfully. But needs a bit more testing. Looking forward to your comments...

JodieM commented 3 years ago

Oh thanks @claboran that looks great... apart from the being untested bit... it's hard to switch out something in a production org that is untested... (but don't ask why we are using a many year old unofficial library in production). Anyway I will at least ask the dev team if they will be willing to test it, and we will ensure we test it on a sandbox and test site :).

claboran commented 3 years ago

@JodieM: thanks a lot. We are migrated one of our connected apps and what should I say, no problems so far. But we are still in UAT phase, so let's see. Security is always a sensitive topic.

deesejohn commented 3 years ago

The ForceClient accepts HttpClients as constructor arguments (https://github.com/wadewegner/Force.com-Toolkit-for-NET/blob/master/src/ForceToolkitForNET/ForceClient.cs#L30). I believe you could write some middleware (DelegatingHandler) to handle creating the JWT and setting the authentication header.