Using OAUTH to authenticate Salesforce customer users failing

Question

I'm a bit of a salesforce / web noob, but am testing out the customer 360 external identity licences, along with customer users. My main goal is to authenticate a customer user using OAUTH, get an access token, then use the Salesforce web APIs to access some relevant bits of info for the customer user. However I just can't seem to figure out how to get the customer user authenticated despite being able to do the same just fine for my personal admin user account.

I have the following setup:

• a bunch of external identity licences
• a profile with the external identity user licence assigned, with the API enabled setting checked.
• a connected app setup with relaxed IP restrictions set, all users may self authorize set, OAUTH settings enabled, device flow enabled, and the full access OAUTH scope selected.
• an end customer contact with an associated end-customer user, assigned to the external identity profile and thus external identity user licence.

And I'm POSTing to the test token endpoint (https://test.salesforce.com/services/oauth2/token).

I've tried two auth flows, password and device flow for IOT as I want to integrate this with a command line app (which the IOT flow is good for apparently), and while both succeed for my personal salesforce user credentials, they both fail for my test user account credentials.

1. The server response for the password flow is as follows:

{
    "error": "invalid_grant",
    "error_description": "authentication failure"
}

End-customer users don't appear to have a security token so I've just been using the password on its own. I can't seem to find a way to generate a security token for these types of users but suspect this could be the issue for this flow.

2. When trying the device flow the returned verification uri is always https://test.salesforce.com/setup/connect but attempting to login on this page as the customer-user fails with this error:

Please check your username and password. If you still can't log in, contact your Salesforce administrator".

I am definitely providing the correct customer user credentials here so have no idea why this fails.

Does anyone have any ideas on how to get this working?

Answer 1

@eyescream nudged me in the right direction so here's the solution for anyone in the same position as me.

Authentication of external identity customer users is not done using the normal OAUTH REST endpoints (https://test.salesforce.com/services/oauth2/token or https://login.salesforce.com/services/oauth2/token).

Instead you have to setup an experience cloud site, add your customer user profile to the sites list of member profiles, then authenticate using a site specific AUTH endpoint.

For example, if your experience cloud URL is https://sandboxname-companyname.instanceid.force.com, then your OAUTH token endpoint would be at:

https://sandboxname-companyname.instanceid.force.com/services/oauth2/token

Extra things to note:

1. customer user accounts cannot authenticate using the username-password flow.
2. the device flow for IOT (or command line apps) will return a verification URL that customer users cannot log in to (https://test.salesforce.com/setup/connect). You can instead use the experience site connect URL (https://sandboxname-companyname.instanceid.force.com/sitename/setup/connect)