Manage Access Through a Custom Connected App Handler

Write a custom connected app handler in Apex to customize how the connected app is invoked. The custom handler can support new authentication protocols or respond to user attributes in a way that benefits a business process.

Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience

Connected Apps can be created in: Group, Professional, Enterprise, Performance, Unlimited, and Developer Editions

Connected Apps can be installed in: All Editions

User Permissions Needed
To read, create, update, or delete connected apps:	Customize Application AND either Modify All Data OR Manage Connected Apps
To update all fields except Profiles, Permission Sets, and Service Provider SAML Attributes:	Customize Application AND either Modify All Data OR Manage Connected Apps
To update Profiles, Permission Sets, and Service Provider SAML Attributes:	Customize Application AND Modify All Data AND Manage Profiles and Permission Sets
To install and uninstall connected apps:	Customize Application AND either Modify All Data OR Manage Connected Apps
To install and uninstall packaged connected apps:	Customize Application AND either Modify All Data OR Manage Connected Apps AND Download AppExchange Packages

From Setup, enter Connected Apps in the Quick Find box, then select Manage Connected Apps.
Click Edit next to the connected app that you are configuring access for.
Under Custom Connected App Handler, enter the name of the Apex Plugin class you created to customize the behavior of the connected app.
For Run As, select the user account that the plug-in runs on behalf of.
If the user isn’t authorized for the connected app, use the authorize method. See the ConnectedAppPlugin class in the Apex Code Developer's Guide.

ISVforce Guide

Manage Access Through a Custom Connected App Handler