1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399

/** 
* Name: Protected Rest Class
* Author: Daniel Llewellyn (Kenji776, @Kenji776, Kenji776@gmail.com)
* Date: 5/12/2014
* Description: Example for showing how to authenticate given user credentials against Salesforce itself. As far as I know Salesforce does not offer any 'easy'
               way to check and see if user credentials are valid from with Apex. This makes creating your own login system/portal/SSO near impossible since you then 
               have to rely on customer portal/high volume licenses which have their own config involved and their own set of credentials. So if you wanted an app that
               is hosted on SF and actually authenticates aginst SF as well you were out of luck (as far as I know. Seems like there is always something that i don't know about).
               Anyway this service can check credentials, give you a valid session token and allow you to then perform any operations provided by this API or any other API that can take a 
               session ID. This is also nice because since it is REST based and supports callbacks, and all data is JSON encoded it is very easy to use with a javascript app.

* More Info: https://iwritecrappycode.wordpress.com/2014/05/12/validating-user-credentials-from-visualforcesalesforce-sites
**/
@RestResource(urlMapping='/ProtectedRest/*')
global class ProtectedRest {

    /**
    * To use this rest service first the user must issue a call to the /login GET method. if the credentials are valid 
    * for this org, that call will return a session ID
    **/
    
    @HttpGet
    global static void doGet() 
    {
        //setup return data
        RestContext.response.addHeader('Content-Type', 'application/json');
        RestResponseWrapper thisResponse = new RestResponseWrapper(RestContext.request);

        try
        {       
            RestRequest req = RestContext.request;
            RestResponse res = RestContext.response;
            
            //figure out what the client is trying to do with this request. The 'VERB' should be the second part of the URI
            string methodName = thisResponse.uriComponents[1];
            
            //check to see if they have included a session ID
            String sessionId = RestContext.request.params.get('sessionId');
            
            //handles the login call
            if(methodName == 'login')
            {
                String username = RestContext.request.params.get('username');
                String password = RestContext.request.params.get('password');
                String orgId = RestContext.request.params.get('orgId');
                String loginDomain = RestContext.request.params.get('domain');
                loginResult thisResult = validLogin(username,password,orgId,loginDomain);
                     
                if(!thisResult.success)
                {
                    throw new applicationException('Invalid Login');
                }
                else
                {
                    thisResponse.responseData = thisResult;
                }
            }
            //if they arn't trying to login and they don't have a valid session ID, abort processig. Throw an error.
            else if(sessionId == null || !validSession(sessionId))
            {
                throw new applicationException('Invalid Session Id. Please login with /login?username=uname&password=pword and then provide it with ?sessionId=sessionid');
            }
            
            //now since above we checked to see if they have a valid session ID, now we can just check to see what other method they might have requested to run. In
            //this case if it is queryAll, run the query.
            if(methodName == 'queryAll')
            {
                thisResponse.responseData = [select name, id, email from contact];
            }
        }
        catch(exception e)
        {
            thisResponse.success = false;
            thisResponse.message= e.getMessage();
        }
        
        //return the data to the client.
        RestContext.response.responseBody = formatResponse(thisResponse);  
    }

    @HttpDelete
    global static void doDelete() 
    {
        RestContext.response.addHeader('Content-Type', 'application/json');
        RestResponseWrapper thisResponse = new RestResponseWrapper(RestContext.request);
        
        try
        {
            String sessionId = RestContext.request.params.get('sessionId');
            
            if(!validSession(sessionId))
            {
                throw new applicationException('Invalid Session Id. Please login with /login?username=uname&password=pword and then provide it with ?sessionId=sessionid');
            }
            
            RestRequest req = RestContext.request;
            RestResponse res = RestContext.response;
    
            Id objectId = thisResponse.uriComponents[1];
            string objectType = objectId.getSobjectType().getDescribe().getName();
            
            string queryString = 'SELECT Id FROM '+objectType+' WHERE Id = :objectId limit 1';
            list<sobject> resource = database.query(queryString);
            
            database.deleteResult[] deleteResult = database.delete(resource,false);
            thisResponse.responseData = deleteResult;
        }
        catch(exception e)
        {
            thisResponse.success = false;
            thisResponse.message= e.getMessage();
        }        
        RestContext.response.responseBody = formatResponse(thisResponse);  
    }
    
    //upsert call.    
    @HttpPost
    global static void doPost(string jsonString) 
    {
        RestContext.response.addHeader('Content-Type', 'application/json');
        RestResponseWrapper thisResponse = new RestResponseWrapper(RestContext.request);
        
        try
        {
            String sessionId = RestContext.request.params.get('sessionId');
            
            if(!validSession(sessionId))
            {
                throw new applicationException('Invalid Session Id. Please login with /login?username=uname&password=pword and then provide it with ?sessionId=sessionid');
            }
             
            //I have no idea if this chunk works. I havn't tried it. My guess is that we'll have to somehow cast the generic sobject to the proper type before 
            //attempting and DML.    
            sObject thisResource = (sObject) JSON.deserialize(jsonString,sObject.class);
            database.upsertResult saveResult = database.upsert(thisResource,false);
            thisResponse.responseData = saveResult;
        }
        catch(exception e)
        {
            thisResponse.success = false;
            thisResponse.message= e.getMessage();
        }          
        RestContext.response.responseBody = formatResponse(thisResponse); 
        
    }
    
    /**
    * checks to see if a valid sessionId is valid by using it to construct a simple request against the SOAP API.
    * I really hope I can find a more efficient way to check to see if a session ID is valid, because this method kind of sucks
    * @param sessionId the session ID provided by a previous login call
    * @return boolean value of if the sessions is valid or not.
    **/
    public static boolean validSession(string sessionId)
    {
        if(sessionId == null)
        {
            return false;
        }
        //create HTTP Request
        HttpRequest request = new HttpRequest();
        request.setEndpoint('https://na15-api.salesforce.com/services/Soap/u/25.0');
        request.setMethod('POST');
        request.setHeader('Content-Type', 'text/xml;charset=UTF-8');
        request.setHeader('SOAPAction', '""');
        request.setBody(buildSoapPing(sessionId));

        //basically if there is a loginResponse element, then login succeeded; else there
        //  would be soap fault element after body
        HttpResponse response = new Http().send(request);
            
        //Try to read timestamp value from the XML response which will only exist if the request was successfull
        //meaning that the sessionID was valid.
        if(readXmlElement(string.valueOf(response.getBody()), 'timestamp') != null)
        {
            return true;
        }
        return false;
    }
    
    /** 
    * Checks the validity of a provided username and password for a given org ID at the given domain.
    * @param username the username of the person the check. Looks like name@domain.tld
    * @param password the password of the user name to check
    * @param orgId the ID of the organization to validate the credentials against.
    * @param loginDomain the login domain the use, such as 'login' (for a prod/dev instance) or 'test' (for a sandbox instance)
    * @return loginResult a simple object with a boolean success flag and a sessionId if the login is successful.
    **/
    public static loginResult validLogin(string username, string password, Id orgID, string loginDomain)
    {
        loginResult thisResult = new loginResult();
        thisResult.success = false;
        
        //create the HTTP request to send to the SOAP API
        HttpRequest request = new HttpRequest();
        request.setEndpoint('https://' + loginDomain + '.salesforce.com/services/Soap/u/22.0');
        request.setMethod('POST');
        request.setHeader('Content-Type', 'text/xml;charset=UTF-8');
        request.setHeader('SOAPAction', '""');
        request.setBody(buildSoapLogin(username,password));

        //basically if there is a loginResponse element, then login succeeded; else there
        //  would be soap fault element after body
        HttpResponse response = new Http().send(request);
        
        final Boolean verified = response.getBodyDocument().getRootElement()
          .getChildElement('Body','http://schemas.xmlsoap.org/soap/envelope/')
          .getChildElement('loginResponse','urn:partner.soap.sforce.com') != null;
        
        
        //if the login is valid, now check to see if the orgId this account is for matches the given orgId
        if(verified)
        {
            final string userOrgId = readXmlElement(string.valueOf(response.getBody()), 'organizationId');
            if(orgId == orgId)
            {
                thisResult.sessionId = readXmlElement(string.valueOf(response.getBody()), 'sessionId');
                thisResult.success = true;
            }
        }
        return thisResult;
    }
    
    /**
    * builds SOAP XML for checking login credentials provided.
    * @param username username to include in the login request
    * @param password password to include in the login request
    * @return a block of SOAP/XML to be sent to the API
    **/
    private static String buildSoapLogin(String username, String password)
    {
        XmlStreamWriter w = new XmlStreamWriter();
        w.writeStartElement('', 'login', 'urn:partner.soap.sforce.com');
        w.writeNamespace('', 'urn:partner.soap.sforce.com');
        w.writeStartElement('', 'username', 'urn:partner.soap.sforce.com');
        w.writeCharacters(username);
        w.writeEndElement();
        w.writeStartElement('', 'password', 'urn:partner.soap.sforce.com');
        w.writeCharacters(password);
        w.writeEndElement();
        w.writeEndElement();
        
        String xmlOutput = 
              '<Envelope xmlns="http://schemas.xmlsoap.org/soap/envelope/"><Body>' 
            + w.getXmlString() 
            + '</Body></Envelope>';
        w.close();
        
        return xmlOutput;
    }  
    
    /**
    * builds SOAP XML for getting server timestamp from the partner API of the org.
    * used for pinging the SOAP api with a session token to see if it is valid.
    * @param sessionId a sessionId given by a previous login call.
    * @return a block of SOAP/XML to be sent to the API.
    **/
    private static String buildSoapPing(string sessionId)
    { 
        string xmlData = '<?xml version="1.0" encoding="utf-8"?>';     
        xmlData += '<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:partner.soap.sforce.com">';  
        xmlData += '<soapenv:Header>';  
        xmlData += '<urn:SessionHeader>';  
        xmlData += '<urn:sessionId>'+sessionId+'</urn:sessionId>';  
        xmlData += '</urn:SessionHeader>';  
        xmlData += '</soapenv:Header>';  
        xmlData += '<soapenv:Body>';  
        xmlData += '<urn:getServerTimestamp />';  
        xmlData += '</soapenv:Body>';  
        xmlData += '</soapenv:Envelope>';  
        return xmlData;   
    }  
    
    /**
    * Reads a single XML attribute element from an XML document
    * useful for just getting a single element from some XML without having to go through the complexity of 
    * full on parsing.
    * @param xmlBody the XML document body to find elementName in
    * @elementName the XML element to read the value from and return. 
    * @return the value of the element if it exists, or null if it does not.
    **/
    public static string readXmlElement(string xmlBody, string elementName)
    {        
        Xmlstreamreader reader = new Xmlstreamreader(xmlBody);
        
        while(reader.hasNext()) {
            if (reader.getEventType() == XmlTag.START_ELEMENT &&  reader.getLocalName() == elementName)
            {
                reader.next();
                return getDecodedString(reader);
            }
            reader.next();
        }     
        return null;
    }



    /**
    * returns rest params (things after the main url, separated by /) in a list of strings.
    * @param url the url to evaluated
    * @return a list of strings that were separated by /
    **/
    global static list<string> getResourcePathChunks(string url)
    {
        list<string> returnParams = new list<string>();
        
        
        integer endOfUrl = url.indexOf('?');
        if(endOfUrl == -1)
        {
            endOfUrl = url.length();
        }
        //clean up the url, make sure we are only dealing with the section we want to. After the host name, before the ? mark.
        //i've seen in come in with the full host name, and also just the relative portion, so we gotta make sure it's exactly the same
        //from here on in, or else the array it returns could get all messed up.
        if(url.indexOf('/apexrest/') > 0)
        {   
            url = url.substring(url.indexOf('/apexrest/')+10,endOfUrl);
        }  
        else
        {
            url = url.substring(1,endOfUrl);
        }            
        list<String> URLParams = url.split('/'); 
         
        for(string thisParam : urlParams)
        {
            returnParams.add(EncodingUtil.urlDecode(thisParam, 'UTF-8'));
         
        }   
        
        return returnParams;           
    }
    
    /**    
    * take one of those wrapper objects and format it by wrapping it in a callback if needed, and serializing 
    * the result into json. Callbacks allow for cross domain javascript requests. Uses callback param in the url
    * @param responseData an object of whatever data you want to return to the client. Can be anything that can be serialized as JSON
    * @return a blob to be sent to the client. JSON encoded, wrapped in callback if one is provided in the URL.
    **/   
    public static blob formatResponse(object responseData)
    {
        string response;
        String callback = RestContext.request.params.get('callback');
        if(callback != null)
        {
            response = callback + '(' + JSON.serialize(responseData) + ');';
        }    
        else
        {
            response = JSON.serialize(responseData);
        }
        return blob.valueOf(response);
    }  
    
    /**
    * Decodes a URL encoded string into a non encoded string
    **/
    public static String getDecodedString(Xmlstreamreader reader)
    {
        return EncodingUtil.urlDecode(reader.getText(), 'UTF-8').trim();
    }

    /**
    * simple wrapper response class. Makes it so all replies via this API have the same basic structure
    * including a boolean success flag, a message, any sObjects affected and some debugging params.
    **/
    public class restResponseWrapper
    {
        public string message;
        public boolean success;
        private list<string> uriComponents; 
        public map<string,string> params;       
        public object responseData;
        public object inputData;
        private string requestURI;
        
        public restResponseWrapper(RestRequest reqContext)
        {
            uriComponents = getResourcePathChunks(reqContext.requestURI);
            message = 'run successful';
            success = true;
            params = reqContext.params;
            requestURI = reqContext.requestURI;
        }
    }
        
    /**
    * Result of login call. More data could be populated here, but this is all we need for now
    **/
    public class loginResult
    {
        public boolean success{get;set;}
        public string sessionId{get;set;}
    }    
    
    /** Custom Exception Class **/
    public class applicationException extends Exception {}
}