Issue Accessing Salesforce via n8n with OAuth 2 Method - OAUTH_APPROVAL_ERROR_GENERIC Related to full Scope

[Alaa_MZOUGHI]

Hello everyone,

I’m encountering a problem while trying to access Salesforce via n8n using the Salesforce OAuth 2 method. The issue arises specifically when I remove the scope full. Here’s the detailed breakdown of the situation:

Issue:

Whenever I set the scope to full, I can connect without any issues.

However, when I remove the full scope and include all the other recommended scopes (such as refresh_token and offline_access), I receive the following error:

OAUTH_APPROVAL_ERROR_GENERIC: An unexpected error has occurred during authentication. Please try again.

Configuration Details:

1. OAuth Scopes:

• According to the Salesforce documentation on n8n, only refresh_token and offline_access are required ⇾ All the scopes except full have been added on my end.

2. Salesforce Settings:

• Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows: Disabled
• Require Secret for Web Server Flow: Disabled
• Require Secret for Refresh Token Flow: Disabled

Steps I’ve Taken:

• Set up OAuth credentials in Salesforce.
• Configured n8n with the all the scopes except full.
• Disabled all the necessary settings in Salesforce as mentioned above.

Please share your workflow

Information on the n8n setup

• **n8n version: 1.41.1
• **Database (default: SQLite): Postgresql
• **n8n EXECUTIONS_PROCESS setting (default: own, main):default
• **Running n8n via (Docker, npm, n8n cloud, desktop app): Docker - self hosted
• **Operating system: Ubuntu 22.04

[Ludwig]

Hi @Alaa_MZOUGHI!

Thanks for reaching out here. This is where we prefer support cases in so that the community can benefit from the knowledge.

Like I shared in response to your email, our normal recommendation for this issue is to disable pkce for the app in Salesforce but I see you’ve already done that. Do you have any IP restrictions on the profile you are attempting to authenticate with inside of Salesforce? Help And Training Community

Here are some additional resources that may be helpful.

Salesforce Scope

Hey @Yash_Khatri, Salesforce require the full scope if you want your application to have access to all the data accessible by the logged in user and it includes all other scopes. This scope does not include a refresh token so you need to include refresh_token as well. The offline_access scope whill allow the app to interact with the users data while the user is “offline” whatever that actually means The docs we follow are here: Help And Training Community Did you find an issue …

Unable to connect Salesforce to n8n with OAuth2

Hi everyone, first forum question after two years of daily use, but now I’m stumped! I need to connect n8n to a Salesforce account in production using the Salesforce OAuth2 API. I followed the tutorial right here: But when I enter Client ID + Client Secret and click on “Connect my account”, a page opens asking me if I accept, I accept and then nothing. A blank page that goes round in circles. I’ve set all the permissions, tried to tick values… Here are all the values: [CleanShot 2023-07-…

[Alaa_MZOUGHI]

Hi Ludwig,

I would like to clarify that the issue we are facing is not related to IP restrictions. We have set the IP Relaxation option to “Relax IP Restriction” in the AUTH POLICY of our connected app on Salesforce, which should address any potential IP-related access concerns.

I’ve reviewed the article you sent (Salesforce Scope) and noted that n8n requires ‘full’ as a scope. This requirement is a significant concern for us, as it is not feasible to request full scope access from our clients due to strict security and compliance requirements. Moreover, there seems to be a discrepancy in the documentation, which only specifies the need for ‘offline_access’ and ‘refresh_token’, but does not mention the necessity of ‘full’ scope for authentication.

[Ludwig]

Hi @Alaa_MZOUGHI,

Thank you for the information regarding the IP restrictions. Per that link my colleague mentions that Salesforce requires full as a scope in certain circumstances - not that n8n does.

Salesforce Scope

Hey @Yash_Khatri, Salesforce require the full scope if you want your application to have access to all the data accessible by the logged in user and it includes all other scopes. This scope does not include a refresh token so you need to include refresh_token as well. The offline_access scope whill allow the app to interact with the users data while the user is “offline” whatever that actually means The docs we follow are here: Help And Training Community Did you find an issue …

I’ll check with our engineering team during Berlin operating hours tomorrow and check whether we also in fact require that scope or another and a change is needed in our documentation.