Event Notifications not being created for Transactions from APEX SDK

Hi Charles,

Thanks for your post!

I have a developer blog series about configuring event notification in Salesforce. (These are additional steps you need to do when developing with APEX SDK, instead of using OneSpan SFDC connector)
https://www.onespan.com/blog/onespan-sign-developers-oauth-event-notification-salesforce-part-1

https://www.onespan.com/blog/onespan-sign-developers-oauth-event-notification-salesforce-part-2

https://www.onespan.com/blog/onespan-sign-developers-oauth-event-notification-salesforce-part-3

Let me know how this works for you.

Duo

Hi Duo!

I appreciate the quick response! We did go through the 3 page blog and Event Notifications are getting created and we get notifications for PACKAGE_CREATE and PACKAGE_ACTIVATE. The challenge is that Event Notifications only get created for transactions that are created via the VF Page that I have attached. Since the package create one is one, I was hoping that, by using the Apex SDK, it would create a package in OneSpan and that would fire the Event Notification. Are there additional fields that I need to set outside of the 3 page blog to do this?

Hi Charles,

Thanks for the information.

Is your account [email protected] under OS US2 sandbox (https://sandbox.esignlive.com)? From what I saw in the backoffice, it seems that your account hasn't configured the SFDC connector information (I attached the screenshot, red is your account, blue is my testing account). It's the "Update OneSpan Sign Callback Service" section in part2 blog.

Duo

Hi Duo!

I did not realize that the callout didn't go through. I was trying to do a callout through Postman to do the POST for https://sandbox.esignlive.com/api/callback/connectors/salesforceOauth2

Is there a better way to make this callout instead of via Postman?

You can also leverage our API Swagger:

https://community.onespan.com/products/onespan-sign/sandbox#/Callback/api.callback.connectors._origin.post

Another way is to contact our support team and have them configure via backoffice. This could be more official when you later go live to production environment.

Duo

Hi Duo!

I will reach out to Support to get it set up then! Thank you so much for looking into this!

Hi Duo,

After doing more testing and syncing up with OneSpan support, we still aren't able to see any event notifications get generated from Transactions created via the Apex SDK. Is this the expected functionality? Could you verify if the Connectors Callback Account is properly set up? And this might stray too far into Salesforce territory, but it's strange that there is no writeback of any Salesforce custom objects from the managed package when I run the createPackage from Apex code. 

Hi Charles,

Your backoffice settings look good to me, few things to check is that:

-have you whitelisted the OSS service IP(s) in your Salesforce?

-only transactions marked as “data” > “origin” : “OSS” will trigger oAuth callback, if you were testing with transactions created by Apex code, they are default with origin:Salesforce. You can override the origin with Apex code, and another easy way is to create a testing package from your UI portal (https://sandbox.esignlive.com/a/login)

If the callback failed to be delivered, your account email should also receive a notification email carrying the failure reason.

For the write back part, are you also using OSS SFDC connector? Please be aware that packages created by Apex code won't affect the packages created by connector (and their associated custom objects), and vice versa. 

Duo

Ahh yep that would do. I checked the account email and I am seeing all of the attempts to set the event notifications there erroring out. One last question, but for the Reason(s): status code: 401, reason phrase: 401: Unauthorized Error, which part of the blog do I need to redo to verify that the set up is correctly done Duo?

Additionally, is there a way to set or control the date > origin : OSS?

Hi Charles,

First check if your refresh token is correct by building this formula (assuming you are using SFDC sandbox):
https://test.salesforce.com/services/oauth2/token?client_id={your_client_id}&grant_type=refresh_token&refresh_token={the_refresh_token}

If the refresh token is correct, then check if you've granted sufficient permissions to the oAuth client.

Duo

Hi Duo,

I ran the formula and received the below response, which I believe means that the refresh token is correct. Do I need to go to OneSpan Sign's API Access and create a Client App or go to Event Notification and enter a value for the Callback Key?

<OAuth>

<access_token>00DDExxxSdGjpQNsOl4dZPrO</access_token>

<signature>s3sMOx0xxvwHig=</signature>

<scope>refresh_token full</scope>

<instance_url>https://xxx.sandbox.my.salesforce.com</instance_url>

<id>https://test.salesforce.com/id/00DDE00xxMYAZ</id>

<token_type>Bearer</token_type>

<issued_at>1685036843486</issued_at>

</OAuth>

Hi Charles,

Yes, this means your refresh token is correct. For sufficient permissions, I actually meant the OAuth scope you've assigned for your connected app in Salesforce.

Duo

Hi Duo,

I tried each of the below urls, but each returned with the 401 error. I have added the current set up I have as well:

https://login.salesforce.com/services/oauth2/success

https://test.salesforce.com/services/oauth2/success

https://xxx.my.salesforce.com/services/oauth2/success

Hi Charles,

Do you currently have a support ticket open? It could be easier if we communicate there. 

Back to the 401 error, I have an assumption that it's caused by your regular OSS callback. I saw you have both basic (using callback key) and oAuth callback services configured, both pointing to the same callback URL. I would suggest to disable the basic authentication callback first then test again. You can clear the regular callback configurations from your UI portal as shown in the attached screenshot.

PS: if you saw a SFDC callback incoming, it's sent by me manually.

PS2: I couldn't find packages created from today in your account, can you give me an example package ID for reference?

Duo

Hi Duo,

I had one when I stated this post a few weeks back, CS0130713.

I did try clearing the configurations from the UI portal, and now no errors are sent to our account email, but there are no event notifications generated.

Thanks for the information, I was looking at the wrong account. 

In your APEX code, can you overwrite the pkg.data.origin as "OSS" like below, and try with another test package?

            OneSpanAPIObjects.Package_x pkg = new OneSpanAPIObjects.Package_x();
           
            pkg.data.origin = 'OSS';

            ......

Duo

Hi Duo,

I created this package a few minutes ago, along with using the data.origin as 'OSS'. '9_AKM_M8RpYA9SSrDvXkz6w6DJ0=' I tried to manually create all of the relevant Onespan custom objects in Salesforce, but if I try to view the package, I get the attached error.

I don't see any errors from the account email we have, but we still don't receive any Event Notifications from packages like these. Just to clarify, it seems like, in creating transactions from Apex Code, then OneSpan will not create or write Salesforce custom objects for that package is that correct?

Hi Charles,

For the "Cannot view package" error, it's expected because the transaction you created with Apex code links to your gmail account (OSS account), while the connector was connected to your working email account. Although you've manually set the custom objects (e.g. owner ID), the API Keys in use are different.

I can see the event notification sending out from the internal logs and I didn't find failure messages. Were you monitoring the traffic from developer console (see attachment)? From the screenshot, the "/oss/callback" ones are for my custom API endpoint, and "/ESL/EventNotification" ones are for the connector callback.

And yes, creating transactions from Apex Code, then OneSpan will not create or write Salesforce custom objects for that package.

Duo

Hi Duo,

Gotcha, that makes sense then. But to follow up then, is there a way to have those keys connected so that we don't end up with the 'Cannot View Package' error? I have a feeling if I can connect via apex the same way the users who manually create the transactions do, it will work.

I keep querying in Salesforce for any Event Notifications records to be created. I only see ones from users who manually created the transactions on the OneSpan VF page, but there are none from the apex driven ones.

Hi Charles,

I haven't tried it myself, but from my understanding, if you use the same API key in Apex code (and don't forget to migrate your oAuth configurations to that account), it should be possible to leverage SFDC connector and custom Apex code with the same account.

For the OAuth callback issue, do you still have your support ticket open? You can request an online session to troubleshoot the issue.

Duo

Hi Duo,

We're running into the same issue again with Event Notifications not being created from Apex created OneSpan Transactions. Is there a list of fields that we need to have set on the transaction in order for it to create Event Notifications to Salesforce?

Below is an example of Transaction data we set when we send the create transaction to OneSpan:
OneSpanAPIObjects.Data packageData = new OneSpanAPIObjects.Data();
       packageData.origin = 'oss';
       packageData.sdk = 'Apex v1.0';
       packageData.version = '5.1';
       pkg.data = packageData;