Salesforce SSO: Add support for Client Credentials Flow

[FlipWarthog]

Hello! Long time.

My client's Pardot support team recently reached out to inform me that we'll need to change our Pardot integrations from Salesforce SSO Username-Password Flow to Client Credentials Flow.

It's been a while since I'd done anything new with this lib so I had to remind myself...

Looking at the API, both of grant_type=password and grant_type=refresh_token are supported out of the box but grant_type=client_credentials is not. Fortunately, the API's withCustomAuthenticationHandler method will allow me roll my own auth handler to support the conversion (great design!).

Once I get our integration working with this method using grant_type=client_credentials I will post back with that in-place solution as well as a PR to add it as a first class feature of this library.

cc @melloware

[FlipWarthog]

I think I've gotten it to the minimal change to get it working w/ the current latest lib:

SsoClientCredentials.java

import com.darksci.pardot.api.config.SsoLoginCredentials;

/**
 * Defines credentials for authenticating to Pardot API using Salesforce SSO.
 */
// @formatter:off
public class SsoClientCredentials extends SsoLoginCredentials {

    /**
     * Constructor.
     * @param clientId Connected App client or consumer Id.
     * @param clientSecret Connected App client or consumer secret.
     * @param businessUnitId Pardot Business Unit Id to connect to.
     */
    public SsoClientCredentials(
        final String clientId,
        final String clientSecret,
        final String businessUnitId) {
        // Need to overload since SsoLoginCredentials requires non-null username/password
        super("", "" , clientId, clientSecret, businessUnitId);
    }

    @Override
    public String toString() {
        return "SsoClientCredentials{"
            + "clientId='" + getClientId() + '\''
            + ", clientSecret='XXXXXXXXXX'"
            + ", businessUnitId='" + getBusinessUnitId() + '\''
            + '}';
    }
}
// @formatter:on

SsoClientCredentialsRefreshHandler.java

import java.util.Objects;

import com.darksci.pardot.api.PardotClient;
import com.darksci.pardot.api.auth.AuthorizationServer;
import com.darksci.pardot.api.auth.SsoSessionRefreshHandler;
import com.darksci.pardot.api.request.login.SsoLoginRequest;
import com.darksci.pardot.api.response.login.SsoLoginResponse;

/**
 * Handles refreshing credentials using SSO Login method.
 */
// @formatter:off
public class SsoClientCredentialsRefreshHandler extends SsoSessionRefreshHandler {
    private final SsoClientCredentials credentials;
    private final AuthorizationServer authorizationServer;

    public SsoClientCredentialsRefreshHandler(final SsoClientCredentials credentials, final AuthorizationServer authorizationServer) {
        super(credentials, authorizationServer);
        this.credentials = Objects.requireNonNull(credentials);
        this.authorizationServer = Objects.requireNonNull(authorizationServer);
    }

    @Override
    public boolean refreshCredentials(final PardotClient client) {
        final SsoLoginResponse response = client.login(new SsoLoginRequest(authorizationServer)
            .withClientId(credentials.getClientId())
            .withClientSecret(credentials.getClientSecret())
            .withGrantType("client_credentials")
        );

        // If we have an API key.
        if (response.getAccessToken() != null) {
            // Set it.
            setApiToken(response.getAccessToken());
            return true;
        }

        return false;
    }

}
// @formatter:on

Usage:

configuration = Configuration.newBuilder()
         .withCustomAuthenticationHandler(new SsoClientCredentialsRefreshHandler(
                  new SsoClientCredentials(sfClientId, sfClientSecret, sfBusinessUnitId), authServer));

[melloware]

Nice!

[Crim]

Cool thanks for posting this back! It will take me a little bit to review and get it merged, but will try to get it wrapped by the end of the week.

[FlipWarthog]

Cool thanks for posting this back! It will take me a little bit to review and get it merged, but will try to get it wrapped by the end of the week.

I should be able to work on an actual PR tomorrow. What I posted was plugging into the API as-is; I think the PR should be even easier since it'd have access to rework some private fields and constructors. I.e., no new classes, just a new method to the client setup

[Crim]

Cool I'll wait for a PR to come across then! :)