Regulating Permitted users via Salesforce API (Using Rails & Restforce)

Question

I'm creating a connected Rails app to our salesforce instance.

Our system has a whole bunch of users and a handful of sysadmins. Salesforce appears to handle much of the CRUD permissions via user profiles at their end, but I also want to make sure only my approved system admins can 'login' to the app, clear oauth and make api calls.

I have a feeling that without securing this our other users would be able to log in but would get raised errors if they ended up requesting objects that they're not set up to view via salesforce permissions. But that's messy... and i don't want them getting that far anyway.

Is there any best practice/advice for when to intervene to secure an app using Oauth and making API calls?

I am using the excellent Restforce Gem and using omniauth to store returned user details.

My current thinking is to create a simple array:

@whitelisted_admins = [user1.uid, user2.uid, user3.uid]

then in my /models/user.rb use before_save to check that the user.name is included in the array:

class User < ActiveRecord::Base
  def self.from_omniauth(auth)
    before_save { user.uid.in?(@whitelisted_admins) }
    where(auth.slice(:provider, :uid).permit!).first_or_initialize.tap do |user|
      user.provider = auth.provider
      user.uid = auth.uid
      user.name = auth.info.name
      user.oauth_token = auth.credentials.token
      user.refresh_token = auth.credentials.refresh_token
      user.instance_url = auth.credentials.instance_url
      user.save!
    end
  end
end

I could then run something before every Restforce API call...

So to my questions:

1. Are there security implications to having this as a hash instead of stored in active record, does that matter much?
2. Is it better to check this at the point of Oauth, API call... or both? (I'm freaking out and going for both as default...)

Answer 1

I wouldn't do an array of admins, that is far more messy then allowing Salesforce to regulate permissions. If all you want to do is restrict non-admin profile users, I would first create and is_admin column on the User model and user that to provide access.

I am assuming your system admins are under a single profile, you can find out if a user is an admin by calling the Salesforce API to get their user profile during the User creation process.

However, in all honesty, I would let Salesforce handle user perms. You are gonna end up injecting a tremendous amount of complexity into your application to manage a minor UX issue.

EDIT - How to Restrict Access to a ConnectedApp:

1. Go to the ConnectedApp

2. Choose the ConnectedApp and click Edit

3. Under OAuth Policies, change the Permitted Users drop down to "Admin Approved Users are Preauthorized" and Save

4. Scroll down to the Profiles section, Click Manage Profiles, Select the profiles you want to give Access to the App to, and Save