[markmainline]

Summary

This change adds support for Salesforce OAuth JWT Bearer authentication when using External Client Apps.
Need to enable JWT and upload certificate in Salesforce External Client App. Then store the key file locally to the sever and set configuration option to the path.

The implementation allows Data Loader to authenticate without:

• Browser interaction
• Stored refresh tokens
• Stored passwords

and is intended primarily for unattended batch execution.

Features

• JWT Bearer authentication flow
• RSA private key signing (RS256)
• External Client App support
• Configurable integration user
• Fallback to existing OAuth mechanisms if JWT authentication fails

New Configuration

sfdc.oauth.useJwt=true

sfdc.oauth.jwt.privateKeyFile=

sfdc.oauth.jwt.username=

Files Modified

• LoginClient.java
• OAuthFlowHandler.java
• AppConfig.java

New File

• JwtBearerFlow.java

Testing

Tested successfully with:

• Salesforce Sandbox
• External Client App
• JWT Bearer Flow enabled
• Certificate-based authentication
• CLI mode
• Batch mode
• Separate server environment (Styx)

Results:

• JWT assertion accepted by Salesforce
• Access token returned successfully
• Data Loader authenticated and executed batch jobs without browser interaction
• No refresh tokens or passwords required

This PR is separate from PR #1668 and focuses only on JWT Bearer authentication support.