[SalesForce] How to do oAuth within Visualforce and be redirected back to the visual force page

The key to this depends on the flow you're using. The specific rules around redirect uris are specific to the User Agent flow. We won't hand out refresh tokens out to those urls if you're using that flow. If you use the webserver flow (response_type=code) and ask for the appropriate scopes, then things work better.

As far as your question about a non-secure endpoint, definetely not. The non-https schemes refer to custom schemes like myiphoneapp://callback

I did manage to get oAuth working with Google previously, but I don't remember what I did with regards to the callback. Either I hardcoded it (it was just a test) or didn't use it. A lot of oAuth systems allow you to use 'oob' which is 'out of bounds', and rather than being automatic you have to get your user to click a button in your UI once they've authenticated and granted access in the provider's UI.

I used the same approach in a Haiku terminal application, it displayed a URL for the user to put in their browser, they authenticated and authorized and then had to return to the console and hit enter to continue. The subsequent request for a session token works because you use the same authorization token that was passed originally and was approved by the user.

The first request you make will be to an authorization URL using your key and secret and that will return a response token.

The next request, once the user has authorized and hit a button to let you know, is to a request an access token, to which you pass the response token you received along with your key and secret. The response token you received is known to be good by the server and hence it provides an access token to you.