Hi all, I have a few questions around using a production connected app for JWT bearer authentication with sandboxes and scratch orgs.
We use a connected app for JWT bearer CI integration with a fairly typical setup - "Use Digital Certificates" with certificate uploaded; scopes api, web, refresh_token, offline_access; "Admin approved users are pre-authorized" option used; permission set associated to the connected app; permission set assigned to a CI user.
I've seen the behaviours below using sfdx force:auth:jwt:grant methods:
- Authenticating with production CI username and production client ID for the first time doesn't require prior consent as expected
- Authenticating with sandbox CI username and sandbox client ID doesn't require prior consent as expected
- Authenticating with sandbox CI username and production client ID does require prior consent ("Error authenticating with JWT config due to: user hasn't approved this consumer") as expected. After sandbox refresh consent is again required for the same username - I was hoping this consent might be retained given the connected app is held in a different org.
- Authenticating using a scratch org username (scratch org was created previously by the CI user), instanceurl https://test.salesforce.com and production client ID does require prior consent (same error as above)
It would be great to confirm if possible:
- Are scenarios 3 and 4 expected behaviour?
- Is there a trick I'm missing to enable JWT-based authentication to a scratch org without approval through the UI? This post suggests it's possible but I can't see what's different from my setup: https://www.wadewegner.com/2018/01/authenticate-to-your-scratch-orgs-using-the-oauth-2.0-jwt-bearer-flow/
Thanks very much!
Hi Petr, thanks I’ve read your post before actually –useful insights and the packaging section is interesting. I’m using a connected app which was created in production and cascaded to sandboxes on refresh. The sandbox versions are allocated different client IDs so presumably technically provisioned as separate apps. Our current CI workflow with sandboxes is to authenticate using the sandbox client ID, which needs to be updated after each refresh. A bit inconvenient but less so than re-approving the SB user in the production app.
Charlie thanks for the link, I hadn’t seen this part of the docs before and this looks like this should be updated. It would be helpful I think to have more detail around authentication to a sandbox using the production connected app as well – e.g. specifying that instanceurl shouldn’t be set to the sandbox mydomain (which doesn’t seem to work) and clarifying that pre-authentication isn’t possible. Interesting to see the note at the bottom of the page “If you get an error that the user is not approved, it means that the scratch org information has not yet been replicated to
https://test.salesforce.com. Wait a short time and try again.” – I’ve seen the error using scratch orgs which were provisioned the previous day so not sure this is accurate.
