forcedotcom/java-sdk — Issue #19: OAuth ForceServiceConnector shares 1 connection for all users
Author: igor-appirio-com
Created: 2012-03-07 11:07:55+00:00
State: open

This seem like a major problem with OAuth implementation or the Sample Spring app with SDK setup is wrong.
In simple web app I want to use SDK and SF as identity provider, let users login to the app using their existing Salesforce user.
For the 1st user it works perfectly well he gets OAuth and connection to the org all works normal, that is great!
Now the PROBLEM! Get 2nd browser session and try login to the same app with different User on different ORG, the OAuth works again and let 2nd user into the app BUT this user now also has same connection as user #1 so they share even though tey are form totally different ORG, what kind of OAuth is this? I assume I am missing something simple in Spring or Security config and need help. Try a bunch of settings nothing seem to work, ForceServiceConnector allways returns the connection for the 1st initially authenticated user to all incoming sessions regardless where they come or what browser it is.

I did try several versions of SDK same result most recent I use 22.0.8-BETA SDK same auth problem Please help.

Here is my security parms in Spring did try session and cookie store:

securityContextStorageMethod
cookie

secure-key-file

storeUsername
true

This may be related to the Spring context being singleton for single app I try to switch that around NO GO!
The demo app from SDK does same effect with multi user login.

Any ideas or fixes to resolve this or it is part of OAuth SDK design?