I'm a bit new to the authentication/authorization landscape and need some advice on how to architect/implement an application that will ultimately be connecting to Salesforce and retrieving information. At a very high-level, I'm building a mobile app that will need to pull Salesforce related data to display to the user. Their specific Salesforce instance uses Google as the identity provider. Also, we are planning to put a gateway in place to orchestrate all communication with Salesforce and potentially do some response aggregation. We're also planning on using Cognito to handle the identity management. My specific questions are:
- Will I be authenticating through the Salesforce auth endpoints? If Salesforce is ultimately using Google as an identity provider, wouldn't it make sense to retrieve that token directly from Salesforce itself?
- Will I need to register the mobile app as an application as well within Salesforce or Google? I understand that Salesforce itself needs registered within Google to allow for using Google as an identity provider in Salesforce, but does it make sense to register both?
- There is currently no need to restrict resource access, as any user that can log in can see everything. Will that effect the implementation at all? Essentially, if a user can log into Salesforce with their Google creds (a.k.a they have a user mapped), then they should be able to see anything.
I'm sure that I'm asking some naive quesitons, and really don't know where to start. I've recently build an Api for Salesforce Connect's use using Azure as an identity provider and that was fairly straightforward, though that was machine-to-machine and much simpler. Any help at all would be greatly appreciated. Thank you.
