Repeatable: Always

Steps to repeat:

  1. Set up a core-only Drupal 7.23 website,
  2. install the Entity API (7.x-1.2), Entity tokens (7.x-1.2), and Libraries (7.x-2.1) modules (as required by Salesforce Suite), and enable them,
  3. install Salesforce Suite (7.x-3.0-beta4+27-dev),
  4. enable all Salesforce Suite modules *except Salesforce SOAP*,
  5. go to Salesforce, logged in, created a connected app with the following settings: http://screencast.com/t/tm2cZZDJ
  6. go to the Authorize page of the Salesforce module of test website and enter the key and secret: http://screencast.com/t/IWskCZfT
  7. click "Authorize."

To repeat, one can simply loop steps 5-7.

Expected Results:

  • Salesforce Module authorizes with Salesforce, enabling normal function of the Salesforce Suite modules.

Actual Results:

  • Most of the time (11 out of 12 times thus far), Drupal removes the "Authorize" window, keeps the screen "dimmed" as if waiting for another window to appear, and refreshes the dimmed out page, returning to the home page (Screenshot: http://screencast.com/t/M2UMfjF9V ). One time it returned a plain white page with the following error: error=redirect_uri_mismatch&error_description=redirect_uri%20must%20match%20configuration (Screenshot: http://screencast.com/t/ux4xDqnj ). In either case, Salesforce remains unauthorized to communicate with my Drupal site (Screenshot: http://screencast.com/t/Jbuxezv8Y ).

OS: Linux 2.6.32-220.23.1.el6.x86_64 GNU/Linux

Database: MySQL 5.5.33

Web Server: Apache 2.2.15 (CentOS)

PHP 3.5.27

Drupal 7.23

Other relevant notes:
My CallbackURL in Salesforce is: https://{my website}/salesforce/oauth_callback (I've tried it with and without a trailing "/" and gotten the same results.)
I'm not enabling the salesforce SOAP module because doing so causes all pages of the site to become non-responsive (Going to any page at the site returns a blank white page with no HTML if you view source.).

If you require additional information, please let me know and I'll do my best to acquire it for you.

Thanks!

CommentFileSizeAuthor
#12 authurl-2127251.patch1.62 KBdbcollies

Comments

leistiko_texvet’s picture

leistiko_texvet commented
Issue summary: View changes
leistiko_texvet’s picture

leistiko_texvet commented
Issue summary: View changes
kostajh’s picture

kostajh commented

I wonder if Overlay module is getting in the way by altering the URL. Can you try disabling it? In this screenshot (http://screencast.com/t/ux4xDqnj), in the URL, there shouldn't be special characters before the /salesforce/oauth_callback bit.

leistiko_texvet’s picture

leistiko_texvet commented

Howdy,

Many thanks for the observant and prompt reply.

I disabled Overlay and the situation persisted, manifesting in the same way.
I ran chron and cleared caches and the situation persisted, manifesting in the same way.
I manually changed the URL in the address bar, changing:

"https://login.salesforce.com/services/oauth2/authorize?redirect_uri=http...{{REDACTED}}/%3Fq%3Dsalesforce/oauth_callback&response_type=code&client_id=3MVG9A2kN3Bn...{{TRUNCATED}}"

to

"https://login.salesforce.com/services/oauth2/authorize?redirect_uri=http://{{REDACTED}}/Dsalesforce/oauth_callback&response_type=code&client_id=3MVG9A2kN3Bn...{{TRUNCATED}}"

This yielded interesting results. I was asked to log in to Salesforce and did so successfully. I was asked if I wanted to give the application (Drupal) permission to access the various services I set it up with. I approved it, it sent me back to my Drupal site, and I got the following error:

Error
The website encountered an unexpected error. Please try again later.
Error message
SalesforceException: redirect_uri must match configuration in Salesforce->requestToken() (line 342 of /var/www/dev2.texvet.org/htdocs/sites/all/modules/salesforce/includes/salesforce.inc).

Screenshot: http://screencast.com/t/VSlqmWMB

The referenced line in salesforce.inc is simply an error handler:

    if ($response->code != 200) {
      $error = isset($data['error_description']) ? $data['error_description'] : $response->error;
      throw new SalesforceException($error, $response->code);
    }

Screenshot: http://screencast.com/t/qPUAdhIJ

I tried recreating this partial "success" and my Drupal install keeps returning me to the error page referenced above, with a slight difference:

Error
The website encountered an unexpected error. Please try again later.
Error message

Salesforce needs to be authorized to connect to this website.
SalesforceException: redirect_uri must match configuration in Salesforce->requestToken() (line 342 of /var/www/dev2.texvet.org/htdocs/sites/all/modules/salesforce/includes/salesforce.inc).

Screenshot: http://screencast.com/t/ZfXJphXCR

I find it interesting that I seemed to successfully authorize Drupal to connect to Salesforce, but Drupal does not acknowledge that authorization. Likely, this is because of the URI mismatch.

Barring additional guidance, my next step will be to disable all non-essential modules (especially looking for anything that may alter URLs) in my "clean" Drupal install and try again, checking to see if it adds additional characters to the URL Drupal passes to Salesforce.

Regards,

Jonathan L.

leistiko_texvet’s picture

leistiko_texvet commented

I disabled a number of non-essential (for this) core modules (Color, Comment, Contextual, Dashboard, Field UI, List, Menu, Number, Path, RDF, Search, Shortcut, Toolbar) and the situation persists as most recently described.

After reading the article at:

http://www.webmasterworld.com/apache/4138119.htm

...and thinking about how one of the "constants" in this, despite my using different Drupal installs and different Salesforce accounts, is the hosting service I'm with, I strongly suspect that something on the server is replacing the characters “:” “?” and “=“ with “%3A” “%3F” and “%3D” (respectively) in the URL Drupal sends to Salesforce. I'm consulting with my server provider to see if they can shed some light on this.

leistiko_texvet’s picture

leistiko_texvet commented

I feel like a total monkey. It was simply not having the "?q=" in the Callback URL at Salesforce, along with testing it too quickly to see if it was working or not.

Important note: The correct format for your Callback URL at Salesforce is:

https://{{YOUR.WEBSITE}}/?q=salesforce/oauth_callback

Do not expect the system to immediately react to this change. Give it a good 30 minutes or more before testing it.

Jonathan L.

leistiko_texvet’s picture

leistiko_texvet commented

Additional note: Sometimes the correct format is:

https://{{YOUR.WEBSITE}}/?q=salesforce/oauth_callback

...and sometimes it is:

https://{{YOUR.WEBSITE}}/salesforce/oauth_callback

Thus far, the only way I've seen to know which will be correct is to check the URL in the address bar when I get a uri_mismatch error.

kostajh’s picture

kostajh commented

Do you want to add a note to the community documentation page and/or submit a patch to the module to suggest that people should try ?q= if the clean URL path doesn't work?

LeMec’s picture

LeMec commented

I am having the exact same issue.

1) I need to add ?q= in the url
2) I get to salesforce and allow the connected app
3) Get this error :

The website encountered an unexpected error. Please try again later.

Error messageSalesforceException: redirect_uri must match configuration in Salesforce->requestToken() (line 342 of /hermes/bosweb26d/b841/ipg.nissimbiz/drupal/sites/all/modules/salesforce/includes/salesforce.inc).

barbapapa_’s picture

barbapapa_ commented

Hello,

I have an issue to authorize Salesforce too.
I have the error: error=redirect_uri_mismatch&error_description=redirect_uri%20must%20match%20configuration
On this URL: https://login.salesforce.com/services/oauth2/authorize?redirect_uri=http......

And when I delete manually the "/%3Fq%3D" (?q=) I can login in salesforce and I'm redirected to an error page of my site:
SalesforceException : redirect_uri must match configuration dans Salesforce->requestToken() (ligne 342 dans /sites/all/modules/salesforce/includes/salesforce.inc).

However my callback url is "https://www.site.com/salesforce/oauth_callback" for more than 1 day now.

If you require additional information, please let me know and I'll do my best to acquire it for you.

Thanks!

paultrotter50’s picture

paultrotter50 commented

I am experiencing the same problem with the 7.x-3.0 version of the module.

To clarify, is the ?q= only supposed to be part of the callback if you don't have clean urls enabled on your Drupal install?

Could having the drupal site within a folder on the server be part of why I am experiencing the problem? my site sits at https://mytestingdomainname.co.uk/mytestinginstallfolder/ but the salesforce api help page at admin/help/salesforce instructs me to set my callback to https://mytestingdomainname.co.uk/salesforce/oauth_callback without the reference to the testing folder.

Interestingly when I first set up the module yesterday after trying a few things I got it to connect fine. Today it didn't seem able to authorize and I have been unable to get it to work again. I tried creating a new drupal install and a new Salesforce app to use, and still didn't have any luck.

dbcollies’s picture

dbcollies commented
StatusFileSize
new authurl-2127251.patch1.62 KB

@paultrotter50 I believe your analysis is correct. If your Drupal instance doesn't "live" at the root of your domain, then you'll need to add the path in front of /salesforce/oauth_callback. And, if you're not using Clean URLs, then you'll need to use the ?q= form.

I've rolled a patch (against the current 7.x-3.x version in git) which should update the help text to always show the correct URL for your instance.

Note that I have no involvement with this project (other than as a potential user) so please, DON'T take this patch as anything that's even vaguely supported by the team working on this. You have been warned. ;)

paultrotter50’s picture

paultrotter50 commented

@dbcollies thanks for taking the trouble to confirm my suspicions and making the patch.

It seems like a great idea to build this into the module once it has gone through testing. Unfortunately I’m not up to speed with how to test Drupal patches in the proper way, otherwise I’d help with this myself.

paultrotter50’s picture

paultrotter50 commented

It also seems a good idea if the documentation emphasized the waiting time required. Does anyone know how long you need to wait between updating you settings in your Salesforce app, and the Salesforce module in Drupal and testing the connection? I was banging my head against the wall with this yesterday, as I was sure my settings seemed correct , but could not connect. This morning it connected with no problems, so patience is key!

paultrotter50’s picture

paultrotter50 commented

I spoke too soon! I tried to connect my second testing environment to my second salesforce app, got to the log in screen but it didn't seem to like my username and password. Now going back to the first testing environment, which links to the first salesforce app and the connection seems to be broken! Clicking on Authorize brings up the normal error: error=redirect_uri_mismatch&error_description=redirect_uri%20must%20match%20configuration

Maybe this problem is because both of the testing sites are in subfolders of the same URL?

dbcollies’s picture

dbcollies commented

@paultrotter50 You mentioned a second salesforce app, and also that it didn't take your username and password. Are these running in Salesforce sandbox instances? If so, you might want to look at the "Advanced" section of the authentication screen, and change the "Salesforce Endpoint" to https://test.salesforce.com

Probably not related to your issue, but I thought I'd mention it just in case.

I also like to make sure I do a log out of all Salesforce sessions before I do the Drupal authentication, to make sure that I'm connecting with the user account I mean to use when I do the Drupal authentication. I don't know that this is necessary, but I like to be overly cautious.

paultrotter50’s picture

paultrotter50 commented

Thanks dbcollies. I *think* I have this connecting fine now. I think that my problem was that I had everything working but then ran into the updating after changing mappings issue. Trying to fix this I must have changed the "Salesforce Endpoint" to https://test.salesforce.com. What is actually working for me is having the "Salesforce Endpoint" set to https://login.salesforce.com. I think it might be sensible to change the help text near the "Salesforce Endpoint" telling users that their endpoint is likely to be either https://login.salesforce.com or https://test.salesforce.com. I am not running Salesforce sandbox instances, just connected apps. So maybe that is why I just use login.salesforce instead of test.salesforce?

Sensible time about logging out of salesforce sessions before Drupal authentication .

dbcollies’s picture

dbcollies commented

@paultrotter50 The https://test.salesforce.com endpoint is only for connecting to sandbox instances of Salesforce. So if you're just working against your production instance, it should always be https://login.salesforce.com

Adding that info to the help text might not be a bad idea.

dbcollies’s picture

dbcollies commented
Related issues: +#2297259: Authorization callback URL is not always correct in help text

Just as an FYI - I created a bug report for the help text issue, and attached my patch as a potential fix for it.

aaronbauman’s picture

aaronbauman
he/him
commented
Status: Active » Closed (won't fix)

7.x is no longer supported

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.