Canvas Integration

Why Force.com Canvas integration?

Suppose a sales agent uses a different application for different purpose like:

• Stock control system for order stock
• Salesforce for opportunity creation
•  And whenever a customer is making payment, he has to check the payment portal

What if all these can be done on a single page? Awesome! This can be done by Canvas. All system will still exist however, only the salesforce system is required for all the work by exposing all these systems into salesforce by canvas.

What is force.com Canvas?

• A framework for integrating external web applications within the salesforce. Note- Mashup only integrates UI, not the data but canvas takes care more.
• It works with any web-enabled applications that uses HTTPS
• Used to place the web applications
• Within VF page
• As a publisher page
• In a salesforce console
• In a page layout of standard or custom object
• As a feed item
• Within Salesforce navigation item
• In an open CTI call control tool
• Allow admin to determine who can access the application.
• Canvas framework provides an Apex-based Javascript SDK that
• Allows embedded applications to access Salesforce data layer.
• Provides UI integration capability
• SDK solve the problem of “Same Origin” Policy

What is Same-Origin Policy-

• The Same-origin policy is a web standard which
• permits the applications from the same domain to interact and exchange the data
• does not allow applications from different domains to interact and exchange the data
• This policy protects the end user’s data. If cross domain access allows, then user from one domain can access the data from other domain
• Due to the Same-origin policy, an external application page embedded within salesforce (Using Mashup) cannot communicate with the outer salesforce page because pages are of different origin.

How does Canvas work?

The same-origin policy is overcome through the use of Canvas JavaScript SDK. 

What are the securities aspect of Canvas?

• Like any 3^rd party application accessing salesforce, the canvas app must be registered as a connected app. Connected app framework controls external application to salesforce.
• Canvas allows the use of HTTP POST or HTTP GE
• The session Id and other query parameters are not exposed within the HTTP Post
• Admin can also control accessing using:
• OAuth Policy
• Permission Set
• Session level security
• Usage report is available to monitor the access

Creating a canvas application within the salesforce-

• Create the connected App with the Salesforce to get Consumer Key and Consumer Secret which will be used by 3^rd party application
• Configuring a canvas application  

How Salesforce will access the external application?

Within Salesforce, a canvas app is configured by one of two methods to specify how salesforce will connect the web application:

1. Signed Request
1. Default authentication method
2. Uses HTTP Post
3. While using the signed Request, the canvas app must be configured with “admin-approved users are pre-authorized”
2. OAuth
1. The external application handles OAuth either using its own methods or using method provided in SDK
2. Salesforce perform HTTP GET when invoking Canvas app
3. While using the OAuth, the canvas app must be configured with “admin-approved users are pre-authorized”  or “All user may self-authorize”

Which access method should you choose?

Signed Requests are the preferred access method as salesforce has built-in infrastructure and less chatter across the network. Use oAuth only when an external application already has OAuth Setup with salesforce or company is more comfortable with oAuth.

How to preview the canvas app?

The canvas app previewer allows you to:

• Preview already created app
• Create a Heroku Canvas app

What are the SDK classes and methods?

SDK provider below three canvas classes:

1. Sfdc.canvas – general-purpose function
2. Sfdc.canvas.client- function for client based activities
3. Sfdc.canvas.oauth- functions supporting oauth

It includes the below method:

1. Authentication -to authenticate applications
2. Context- to retrieve context information about the environment in which the canvas application is running
3. Cross-Domain XHR- to send cross-domain request back to salesforce
4. Resizing -to resize the canvas application
5. Events- to send and receive events between multiple applications

To know about other integration API at a glance, pls Click here