Ensuring Deep Linking Works with FusionAuth and Salesforce SSO Integration

[wesley]

We have an integration between FusionAuth and Salesforce following the guide: FusionAuth-Salesforce Integration.

Typically, users access Salesforce via the link https://myapp.my.salesforce.com/customers/services/auth/sso/FusionAuth, which redirects them to the FusionAuth login page.

However, we’re encountering an issue where users cannot navigate to nested routes inside Salesforce. For example:

• A user trying to access https://myapp.my.salesforce.com/customers/services/somenestedpath?someSearchArg=value is not redirected to the FusionAuth login page when they are not logged in.

We need a solution where:

1. Users trying to access any route (including nested routes and query parameters) are redirected to the FusionAuth login page if not logged in.
2. After successful login, users are redirected back to the exact route they were attempting to access.

[wesley]

To handle nested routes and query parameters in this scenario, the solution typically involves using the redirect_uri and state parameters as part of the authentication request. These parameters allow Salesforce to pass the user's intended destination to FusionAuth, so the user can be redirected back to the correct route after login.

Implementation Steps:

1. Configure the Redirect URI:
   Salesforce should include the destination route (including any query parameters) in the state parameter of the authentication request sent to FusionAuth. This ensures that the user's original route is preserved during the login process.
2. State Parameter Usage:
   The state parameter can store the desired nested path and query parameters. Once FusionAuth completes the authentication, it will pass this state parameter back to Salesforce, which can use it to redirect the user to the correct location.
   Example:
   • User tries to access https://myapp.my.salesforce.com/customers/services/somenestedpath?someSearchArg=value.
   • Salesforce sends the following request to FusionAuth:
     https://your-fusionauth-domain/oauth2/authorize?client_id=yourClientId&response_type=code&
     redirect_uri=https://myapp.my.salesforce.com/services/auth/test/FusionAuth&state=/customers/services/somenestedpath?someSearchArg=value
   • After login, FusionAuth redirects back to Salesforce with the state parameter, allowing Salesforce to guide the user to their intended destination.
3. Limitations:
   • Check Salesforce’s documentation to confirm if it supports appending custom state or deep-linking query parameters for redirection.
   • If Salesforce does not support this behavior, it may be a limitation of the platform or the integration.

Next Steps:
Review Salesforce's documentation or consult their support to verify how to include deep-linking information in authentication requests. FusionAuth’s integration supports the state parameter for scenarios like this, but Salesforce must support passing and utilizing this information as part of the redirect process.