Understanding the username-Password oauth authentication Flow

User name-Password Authentication flow can be used for identity authentication when the user has the user's creden. In this process, the user's creden are used by the application to request an access token, as shown in the following steps.

The oauth stream transmits user creden。 back and forth. Use this authentication stream only when necessary. The refresh tag is released.

1. the application uses the user's username and password to request an access token. this is done via an out-of-band POST request to the appropriate Salesforce (Customer Management System) token request endpoint, suchHttps://login.salesforce.com/services/oauth2/token. The following request fields (field) are required:

An example request body might look something like the following:

grant_type=password&client_id=3MVG9lKcPoNINVBIPJjdw1J9LLM82HnFVVX19KY1uA5mu0QqEWhqKpoW3svG3XHrXDiCQjK1mdgAvhCscA9GE&client_secret=1955279925675241571&username=testuser%40salesforce.com&password=mypassword123456

Salesforce verifies (verification) The user credentials, and if successful, sends a response to the application with the access token. This response contains the following values:

An example response body might look something like:

{"id":"https://login.salesforce.com/id/00Dx0000000BV7z/005x00000012Q9P","issued_at":"1278448832702","instance_url":"https://na1.salesforce.com","signature":"0CmxinZir53Yex7nE0TD+zMpvIWYGb/bdJh6XfOH6EQ=","access_token":"00Dx0000000BV7z!AR8AQAxo9UfVkh8AlV0Gomt9Czx9LjHnSSpwBMmbRcgKFmxOtvxjTrKW19ye6PE3Ds1eQz3z8jr3W7_VbWmEu4Q8TVGSTHxs"}

3. The application users the provided access token to access protected user data. Keep the following considrations in mind when using the User-Agent oauth flow:

Since the user is never redirected to login at Salesforce in this flow, the user can't directly authorize the application, so no refresh tokens can be used. if your application requires refresh tokens, you shoshould consider using the Web server or User-Agent oauth flow.

 

Reprinted from: http://www.salesforce.com/us/developer/docs/api_rest/Content/intro_understanding_username_password_oauth_flow.htm