Salesforce: Connecting to iPaaS

1. Read the guidelines for adding users.
2. From Setup, in the Quick Find box, enter Users , and then select Users.
3. Click New User.
4. Enter the user’s name and email address and a unique username in the form of a email address. By default, the username is the same as the email address.

   

   Important Your username must be unique across all Salesforce orgs, including trial and Sandbox orgs. The username must be in the format of an email address, for example, jane@salesforce.com. The email used in your username need not function or match the email address used for the account. You can have the same email address associated with your account across multiple orgs. For example, create unique usernames like jane@company.sandbox and jane@trialorg.company.com, for different accounts that are associated with the same email address. Keep in mind that Salesforce Customer Support can’t change usernames or deactivate users from an org. If you get a Duplicate Username error, check if the username is already in use in your production, trial, or Sandbox orgs. Deactivate or change the username for the user record, then create your account with your desired username in your production org. If you’re unable to change or deactivate a username, contact your Salesforce admin for help. If you’re unable to locate the org where the username is already in use, try a different username to create your account.

5. In Professional, Enterprise, Unlimited, Performance, and Developer Editions, select a Role.
6. Select a User License. Only licenses with remaining seats are displayed. The user license determines which profiles are available for the user.
7. Select a profile, which specifies the user’s minimum permissions and access settings.
8. If your organization has Approvals enabled, you can set the user’s approver settings, such as delegated approver, manager, and preference for receiving approval request emails.
9. Check Generate new password and notify user immediately to have the user’s login name and a temporary password emailed to the new user.

For new Chatter Only users, an administrator must expose the tabs for accounts, contacts, dashboards, and reports. By default, these tabs are hidden for Chatter Only users. And, the admin must turn on Salesforce CRM Content, Ideas, and Answers if they want their Chatter Only users to have access to them. Professional Edition organizations must have Profiles enabled to perform these tasks. For more information, contact Salesforce Customer Support.

You can use a connected app to request access to Salesforce data on the behalf of an external application. For a connected app to request access, it must be integrated with the Salesforce API using the OAuth 2.0 protocol. OAuth 2.0 is an open protocol that authorizes secure data sharing between applications through the exchange of tokens. When developers or independent software vendors (ISV) want to integrate their app with Salesforce, they use OAuth APIs. These OAuth APIs enable a user to work in one app but see the data from another.

Required Editions

1. Create your connected app, and complete its basic information.
2. In the API (Enable OAuth Settings) area of the page, select Enable OAuth Settings.
3. If you’re setting up a connected app for an external application on a device with limited input or display capabilities, such as TVs, appliances, or command-line applications, select Enable for Device Flow.

   A callback URL isn’t used in the device flow. However, when this flow is enabled, the value for the callback URL defaults to a placeholder. You can specify a callback URL if needed, such as when this same client is being used for a different flow.

4. Enter the callback URL (endpoint) that Salesforce calls back to your application during OAuth. It’s the same as the OAuth redirect URI.

   Depending on which OAuth flow you use, the URL is typically the one that a user’s browser is redirected to after successful authorization.

   Because this URL is used for some OAuth flows to pass an access token, the URL must use secure HTTPS or a custom URI scheme.

   If you enter multiple callback URLs, at run time Salesforce matches the callback URL value specified by the app with one of the values in Callback URL. It must match one of the values to pass validation. Separate multiple callback URLs with line breaks. The callback URL field has a limit of 2000 characters, cumulatively. If you enter several URLs and they exceed this limit, create another connected app to manage more callback URLs.

5. If you’re using the JWT OAuth flow, select Use Digital Signatures. If the app uses a certificate, click Choose File, and select the certificate on your system to upload for the JWT OAuth flow.

   

   Important The certificate is limited to 4,000 characters, and the file must be smaller than 4 KB.

6. Select the OAuth scopes to apply to the connected app. OAuth scopes define permissions for the connected app, which are granted as tokens after the app is authorized. The OAuth token name is in parentheses. For a list of scopes and their descriptions, see OAuth Tokens and Scopes.
7. To require the OAuth 2.0 Proof Key for Code Exchange (PKCE) extension for all supported versions of the OAuth 2.0 authorization code flow, select Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows.

   This setting requires PKCE for the web server flow, the hybrid web server flow, the Authorization Code and Credentials Flow, and all variations of the Authorization Code and Credentials Flow including headless registration, headless passwordless login, and headless identity for guest users. With this setting enabled, any of these flows that don’t implement PKCE are blocked for this connected app. For more information on using PKCE to secure your apps, see Proof Key for Code Exchange (PKCE) Extension.

8. To require the app’s client secret in exchange for an access token, select Require Secret for the Web Server Flow.

   

   Important If the client app can’t keep the client secret confidential and it must use the web server flow, deselect Require Secret for Web Server Flow. We still generate a client secret for your app, but this setting instructs the web server flow not to require the client_secret parameter in the access token request. We recommend user agent as a more secure option than web server flow without the secret.

9. To require the client secret in the authorization request of a refresh token and hybrid refresh token flow, select Require Secret for Refresh Token Flow. If you don’t select this option and an app sends the client secret in the authorization request, Salesforce still validates it.You can select this option for web-server based apps that can protect client secrets. But for apps that can’t protect client secrets, such as mobile apps or apps installed on a user’s computer, we recommend against selecting this option.

   

   Note For new connected apps, this selection is automatically enabled. For connected apps created before the Spring ’21 release, this selection isn’t automatically enabled.

10. To configure settings for the client credentials flow, see Configure a Connected App for the OAuth 2.0 Client Credentials Flow.
11. To configure settings for the Authorization Code and Credentials Flow, see Configure a Connected App for the Authorization Code and Credentials Flow.
12. To configure settings for the token exchange flow, see Integrate an App for the Token Exchange Flow.
13. To get a new refresh token each time the refresh token flow is invoked, select Enable Refresh Token Rotation.

    Enabling this setting is a security best practice. With this setting enabled, the old refresh token is automatically invalidated after it’s used, so that each token is used only one time. If someone tries to use a refresh token that’s been rotated out, Salesforce invalidates the current refresh token and any associated access tokens.

14. To configure JSON Web Token (JWT)-based access tokens, see Enable JSON Web Token (JWT)-Based Access Tokens.
15. To authorize a single connected app to introspect all access and refresh tokens within the entire org, select Introspect all tokens.

    By default, all connected apps can introspect their own tokens. In addition, an OAuth client that directly registers OAuth 2.0 connected apps through the dynamic client registration endpoint can check the tokens for itself and its registered apps. See OpenID Connect Token Introspection.

16. To control how the OAuth request handles the ID token, select Configure ID token.

    If the OAuth request includes the Allow access to your unique identifier (openid) scope, the returned token can include the ID token.

    The ID token is always included in access token responses.

    With the primary ID token setting enabled, configure the secondary settings that control the ID token contents in both access and refresh token responses. Specify these settings.

    Setting	Description
    Token Valid for	The length of time that the ID token is valid for after it’s issued. The period can be from 1 to 720 minutes. The default is 2 minutes.
    ID Token Audiences	The intended consumers of the ID token. For example, the target service where you use the ID token, such as https://your_service.com.
    Include Standard Claims	Include the standard claims that contain information about the user, such as the user’s name, profile, phone number, and address. The OpenID Connect specifications define a set of standard claims to be returned in the ID token.
    Include Custom Attributes	If your app has specified custom attributes, include them in the ID token.
    Include Custom Permissions	If your app has specified custom permissions, include them in the ID token.

17. If you’re setting up the app to issue asset tokens for connected devices, select Enable Asset Tokens, and specify these settings.

    Setting	Description
    Token Valid for	The length of time that the asset token is valid after it’s issued.
    Asset Signing Certificate	The self-signed certificate that you created for signing asset tokens. The certificate size is limited to 4 KB.
    Asset Audiences	The intended consumers of the asset token. For example, the back-end service for your connected device, such as https://your_device_backend.com.
    Include Custom Attributes	If your app has specified custom attributes, include them in the asset token.
    Include Custom Permissions	If your app has specified custom permissions, include them in the asset token.

    Make sure to specify the callback URL (endpoint). For example, https://your_device_backend.com/callback.

    Select the Access and manage your data (api) and Allow access to your unique identifier (openid) OAuth scopes, which are required for asset tokens.

18. To use single logout for use cases where Salesforce is an OpenID Connect provider, select Enable Single Logout, and then enter a single logout URL to determine where Salesforce sends logout requests. The single logout URL must be an absolute URL starting with https://.

    These settings are just one part of a single logout configuration. To finish setting up single logout, set the URL where users are redirected after they log out and share information with your OpenID Connect provider. See Configure OpenID Connect Single Logout with Salesforce as the OpenID Connect Provider.

19. After you configure all settings for your connected app, save your changes.

For help with configuring OAuth flows, see OAuth Authorization Flows in Salesforce Help.

Salesforce CLI requires a connected app in the org that you're authorizing. A connected app is a framework that enables an external application, in this case Salesforce CLI, to integrate with Salesforce using APIs and standard protocols, such as OAuth. We provide a default connected app when you authorize an org with the org login web command. For extra security, you can create your own connected app in your org using Setup and configure it with the settings of your choice. You're required to create a connected app when authorizing the org with the org login jwt command.

We don't recommend that you create an External Client App, which is the next generation of Salesforce connected apps, particularly when authorizing a Dev Hub org. The main reason is that using the Dev Hub org to create scratch orgs can lead to errors.

Note

The steps marked Required for JWT are required only if you’re creating a connected app to use with the org login jwt command. In this case you also need a file that contains a digital certificate, such as server.crt. The steps are optional if you’re creating a connected app to use with org login web.

Important

You must have the Approve Uninstalled Connected Apps user permission to complete this task. Org administrators have the permission by default.

1. Log in to your org.
2. From Setup, in the Quick Find box, enter External Client Apps, and then select Settings.
3. Turn on Allow creation of connected apps and click Enable.
4. Click New Connected App.
5. Update the basic information as needed, such as the connected app name and your email address.
6. Select Enable OAuth Settings.
7. For the callback URL, enter http://localhost:1717/OauthRedirect.

   If port 1717 (the default) is already in use on your local machine, specify an available one instead. Then update your sfdx-project.json file by setting the oauthLocalPort property to the new port. For example, if you set the callback URL to http://localhost:1919/OauthRedirect:

   "oauthLocalPort" : "1919"

8. (Required for JWT) Select Use digital signatures.
9. (Required for JWT) Click Choose File and upload file that contains your digital certificate, such as server.crt.
10. Add these OAuth scopes:
    • Manage user data via APIs (api)
    • Manage user data via Web browsers (web)
    • Perform requests at any time (refresh_token, offline_access)
11. Click Save, then Continue.
12. Click Manage Consumer Details.

    If prompted, verify your identity by entering the verification code that was automatically sent to your email address.

13. Click Copy next to Consumer Key because you need it later when you run an org login command. Depending on whether you specify that it's required, also copy the Consumer Secret.
14. Click Back to Manage Connected Apps.
15. Click Manage.
16. Click Edit Policies.
17. In the OAuth Policies section, for the Refresh Token Policy field, click Expire refresh token after: and enter 90 days or less.

    Setting a maximum of 90 days for the refresh token expiration is a security best practice. To continue running CLI commands against an org whose refresh tokens have expired, reauthorize it with the org login web or org login jwt command.

18. In the Session Policies section, set Timeout Value to 15 minutes.

    Setting a timeout for access tokens is a security best practice. Salesforce CLI automatically handles an expired access token by referring to the refresh token.

19. (Required for JWT) In the OAuth Policies section, select Admin approved users are pre-authorized for permitted users, and click OK.
20. Click Save.
21. (Required for JWT) Click Manage Profiles, select the profiles that are pre-authorized to use this connected app, and click Save. Similarly, click Manage Permission Sets to select the permission sets. Create permission sets if necessary.

To specify the consumer key, use the --client-id flag of the org login commands. For example, if your consumer key is 04580y4051234051 and you’re authorizing a Dev Hub org by logging into it from a browser, run this command in a terminal (macOS and Linux) or command prompt (Windows):

sf org login web --client-id 04580y4051234051 --set-default-dev-hub --alias my-hub-org

If you specifed in the connected app that the web login flow requires a client (consumer) secret, the command prompts you for it. The command then opens the login page for you to add your org credentials.

See the reference for org login web and org login jwt for more examples.