Skip to main content
This guide shows you how to use Salesforce as:
  • An OAuth provider, along with the ngrok OIDC Traffic Policy action, to secure your ngrok endpoints
  • The primary identity provider (IdP) for your endpoints
The OIDC Traffic Policy action supplements an ID token that identifies users who log in to your endpoint. Because Salesforce isn’t currently a supported OAuth provider in ngrok, this approach lets you use its OAuth capabilities and add an extra layer of authorization to your endpoints.

​
Why use OIDC to secure your endpoints

The OIDC Traffic Policy action lets you control access to your upstream services and configure routing based on the information that ngrok stores about a user’s authentication and authorization status.

​
Why use Salesforce as an IdP

Using Salesforce OAuth lets you provide single sign-on (SSO) for users of your application, API, or database without separate credentials. ngrok handles the authentication transparently. The people in charge of security and administration at your organization can manage all external application integrations from one place.

​
What you’ll need

  • A Salesforce developer account with administrative rights to create apps.
  • An ngrok Pay-as-you-go account with an authtoken or admin access to configure an endpoint with Traffic Policy and OpenID Connect.

​
1. Create a Salesforce external client app

Create an external client app in Salesforce by following Salesforce’s guide to creating an external client app. When you enable and configure OAuth for the app, use these ngrok-specific settings:
  • Callback URL: https://idp.ngrok.com/oauth2/callback
  • OAuth Start URL: the URL of the Cloud Endpoint you create in the next step
  • Select the openid, profile, and email scopes.
  • Under Permitted Users, allow all users to self authorize.
  • Require the secret for the Web Server flow and the Refresh Token flow.
  • Leave Require Proof Key for Code Exchange (PKCE) disabled, because it causes an error when you log in to your endpoint.
After you save the app, open its OAuth Settings and copy the Client ID (consumer key) and Client Secret (consumer secret). Your issuer URL follows the format https://YOUR_DOMAIN-dev-ed.develop.my.salesforce.com. You use these three values in the next step.

​
2. Create a Cloud Endpoint and add the OIDC Traffic Policy action

Log in to your ngrok dashboard and go to the Endpoints section. Click Create Endpoint, select Cloud Endpoint, and follow the steps in the Cloud Endpoints quickstart to create your endpoint. Add the following Traffic Policy to your endpoint, replacing the placeholder values with the ones you copied from Salesforce:
Click Save. Your Cloud Endpoint now uses the OIDC Traffic Policy action with Salesforce as the IdP.

​
(Optional) Configure an Agent Endpoint from the CLI

You can start an Agent Endpoint with the same policy instead of a Cloud Endpoint. To learn when to use Agent versus Cloud Endpoints, see the documentation on endpoints. Save the Traffic Policy above to a policy.yaml file, then start an Agent Endpoint with it, replacing YOUR_DOMAIN with your ngrok domain: