Apex Developer Guide
jNewer Version Available
ConnectedAppPlugin Class
Namespace
Usage
The class runs on behalf of the current user of the connected app. This user must have permission to use the connected app for the plug-in to work.
Example
This example gives the user permission to use the connected app if the context is SAML and the user has reached the quota tracked in a custom field. It returns the user’s permission set assignments. The example uses InvocationContext to modify a SAML assertion before it’s sent to the service provider.
1global class ConnectedAppPluginExample extends Auth.ConnectedAppPlugin{
2
3 // Authorize the app if the user has achieved quota tracked in a custom field
4 global override boolean authorize(Id userId, Id connectedAppId, boolean isAdminApproved) {
5 // Create a custom boolean field HasAchievedQuota__c on the user record
6 // and then uncomment the block below
7
8 // User u = [select id, HasAchievedQuota__c from User where id =: userId].get(0);
9 // return u.HasAchievedQuota__c;
10
11 return isAdminApproved;
12 }
13
14 // Call a flow during refresh
15 global override void refresh(Id userId, Id connectedAppId) {
16 try
17 {
18 Map<String, Object> inputVariables = new Map<String, Object>();
19 inputVariables.put('userId', userId);
20 inputVariables.put('connectedAppId', connectedAppId);
21
22 // Create a custom trigger ready flow and uncomment the block below
23 // Flow.Interview.MyCustomFlow interview = new Flow.Interview.MyCustomFlow(inputVariables);
24 // interview.start();
25 } catch ( Exception e ) {
26 System.debug('FLOW Exception:' + e);
27 }
28
29 }
30
31 // Return a user’s permission set assignments
32 global override Map<String,String> customAttributes(Id userId, Map<String,String> formulaDefinedAttributes)
33 {
34 List<PermissionSetAssignment> psas = [SELECT id, PermissionSet.Name FROM PermissionSetAssignment
35 WHERE PermissionSet.IsOwnedByProfile = false AND (AssigneeId = :userId)];
36 String permsets = '[';
37 for (PermissionSetAssignment psa :psas)
38 {
39 permsets += psa.PermissionSet.Name + ';';
40 }
41 permsets += ']';
42 formulaDefinedAttributes.put('PermissionSets', permsets);
43 return formulaDefinedAttributes;
44
45 }
46
47 }ConnectedAppPlugin Methods
The following are methods for ConnectedAppPlugin.
authorize(userId, connectedAppId, isAdminApproved)
Signature
public Boolean authorize(Id userId, Id connectedAppId, Boolean isAdminApproved)
Parameters
Return Value
Type: Boolean
If the connected app requires admin approval, a returned value of true indicates that the current user is approved.
authorize(userId, connectedAppId, isAdminApproved, context)
Signature
public Boolean authorize(Id userId, Id connectedAppId, Boolean isAdminApproved, Auth.InvocationContext context)
Parameters
- userId
- Type: Id
- The 15-character ID of the user attempting to use the connected app.
- connectedAppId
- Type: Id
- The 15-character ID of the connected app.
- isAdminApproved
- Type: Boolean
- The approval state of the specified user when the connected app requires approval.
- context
- Type: InvocationContext
- The context in which the connected app is invoked.
Return Value
Type: Boolean
If the connected app requires admin approval, a returned value of true indicates that the user is approved.
customAttributes(userId, connectedAppId, formulaDefinedAttributes)
Signature
public Map<String,String> customAttributes(Id userId, Id connectedAppId, Map<String,String> formulaDefinedAttributes,)
Parameters
- userId
- Type: Id
- The 15-character ID of the user attempting to use the connected app.
- connectedAppId
- Type: Id
- The 15-character ID of the connected app.
- formulaDefinedAttributes
- Type: Map<String,String>
- A map of the new set of attributes from the UserInfo endpoint (OAuth) or from a SAML assertion. For more information, see The UserInfo Endpoint in the online help.
customAttributes(userId, connectedAppId, formulaDefinedAttributes, context)
Signature
public Map<String,String> customAttributes(Id userId, Id connectedAppId, Map<String,String> formulaDefinedAttributes, Auth.InvocationContext context)
Parameters
- userId
- Type: Id
- The 15-character ID of the user attempting to use the connected app.
- connectedAppId
- Type: Id
- The 15-character ID for the connected app.
- formulaDefinedAttributes
- Type: Map<String,String>
- A map of the current set of attributes from the UserInfo endpoint (OAuth) or from a SAML assertion. For more information, see The UserInfo Endpoint in the online help.
- Type: InvocationContext
- The context in which the connected app is invoked.
modifySAMLResponse(authSession, connectedAppId, samlResponse)
Signature
public dom.XmlNode modifySAMLResponse(Map<String,String> authSession, Id connectedAppId, dom.XmlNode samlResponse)
Parameters
- authSession
- Type: Map<String,String>
- The attributes for the authorized user’s session. The map includes the 15-character ID of the authorized user who’s accessing the connected app.
- connectedAppId
- Type: Id
- The 15-character ID of the connected app.
- samlResponse
- Type: Dom.XmlNode
- Contains the SAML XML response generated by the IDP.
Return Value
Type: Dom.XmlNode
Returns an instance of Dom.XmlNode containing the modified SAML XML response.
Usage
Use this method to modify the XML SAML response to perform an action based on the context of the SAML request before it’s verified, signed, and sent to the target service provider. This method enables developers to extend the connected app plug-in to meet their specific needs.
The developer assumes full responsibility for changes made within the connected app plug-in. The plug-in must include validation and error handling. If the plug-in throws an exception, catch it, log it, and stop the process. Don’t send anything to the target service provider.
refresh(userId, connectedAppId)
refresh(userId, connectedAppId, context)
Signature
public void refresh(Id userId, Id connectedAppId, Auth.InvocationContext context)
Parameters
- userId
- Type: Id
- The 15-character ID of the user requesting the refresh token.
- connectedAppId
- Type: Id
- The 15-character ID of the connected app.
- context
- Type: InvocationContext
- The context in which the connected app is invoked.
Return Value
Type: void