Checking the private key at salesforce.com
Is there a good way to validate the private key for HTTP requests from the Salesforce app to my own web server? In other words, I would like to provide every company that installs our application with their own private key. Then every HTTP call from the application to our server (be it json or just a link to a hosted iframe) will look something like this:
groupid = groupid
param1 = value1
param2 = value2
signParam = signValue
Where signValue = md5("groupid=groupid,param1=value1,param2=value2,secretKey"
Then, when I receive a request, I compute the signature the same way to make sure it matches before doing any action on our web server. The problem is that I don't see how I can assign and store a private key for each company that installs our application (that is, so that they keep the secret key when they install them).
Is there a good way to do this that I am missing? And if this is not possible in salesforce, how else do you authenticate web requests before taking action on your own server?
a source to share
Instead of trying to track it down on the Salesforce side, have the salesforce side send the sessionId to your web service to the users, then you can use the API to check that the sessionId gets the user information and verifies locally that the specific user / organization is licensed. There's some articles on the developerforce quiz about using this approach.
a source to share