Dear all,
We are implementing Salesforce as an Identity Provider for a client with multiple apps and APIs which will implement OAuth. Because of the requirements given by the client, the information source for the information provided by SF needs to be verified offline, meaning the information needs to be signed. As SF doesn't support JWT access tokens, we have gone in the direction of using the ID token for this purpose. Now we are trying to implement this scenario with the User Agent flow.
The issue we are having is that, when we hit the SFDC authorize endpoint and ask for the ID token, it seems that when sending the ID token in the URL SFDC switches from GET to POST request once the URL is >2000 characters. Of course, we would need to be able to send more information in the ID token so this is a blocker. We are using the User Agent flow, we have no server, so we can not handle a POST.
Has anyone experienced this issue and do you have a workaround that you used?
Any help appreciated! Thank you!!!
@Chuck Mortimore thanks very much for the reply!
This would however mean that we are not using the User Agent flow, but instead the Web Server flow. And it is our prerequisite to use the User Agent flow as we are using OAuth for SPAs.
So actually - this wouldn't be a viable solution for the needed scenario?
