Salesforce APIs

1. Create a New Profile

Create a new profile or use an existing one. Creating a new profile is recommended. This section describes steps to create a new profile.

1. Log on to your Salesforce cloud account.

2. At the top right, click Setup.

3. In the left pane, under Administer, click Manage Users > Profiles. The Profiles page shows the list of existing profiles.

4. Click New profile. The Clone Profile page is displayed.

   1. From the Existing Profile drop-down list, select Minimum Access - Salesforce.

   2. Enter Profile Name, for example, no_permission_profile.

   3. Click Save.

   The profile is created.

5. Remove the assigned permissions.

   The GUI slightly differs for Salesforce production environment and Salesforce Sandbox.

   Click a tab to view details.

   Salesforce Sandbox

   1. Scroll down to the System section.

   2. Click the System Permissions link. The list of permissions assigned to the profile is displayed. These permissions are based on the profile you selected from the Existing Profile drop-down list.

   3. Next to System Permissions, click Edit. The edit view of the profile is displayed.

   4. Clear all the set permissions.

      Note

      A few permissions are enabled and read-only. They cannot be cleared, just ignore them.

   5. Scroll up the page.

   6. Click Save. The Permission Changes Confirmation dialog box is displayed.

   Salesforce (Production Environment)

   1. Next to Profile Detail, click Edit. The edit view of the profile is displayed.

   2. Scroll down to the Administrative Permissions section. The list of permissions assigned to the profile is displayed. These permissions are based on the profile you selected from the Existing Profile drop-down list.

   3. Clear all the set permissions.

      Note

      A few permissions are enabled and read-only. They cannot be cleared, just ignore them.

   4. Scroll down to the General User Permissions section.

   5. Clear all the set permissions.

   6. Scroll up the page.

6. Click Save to confirm the changes.

2. Create a New User

Create a new user or edit an existing one to change the profile. This section describes steps to create a new user.

1. In the left pane, under Administer, click Manage Users > Users. The All Users page is displayed.

2. In the middle of the page, click New User. The New User page is displayed.

3. Specify the user details such as first name, last name, alias, email address, username, and nickname.

4. Select the User License that has the Manage Encryption Keys and View Event Log Files system permissions.

5. From the Profile drop-down list, select no_permission_profile (the profile created in 1. Create a New Profile).

6. Click Save.

The user is created.

3. Create a New Permission Set

1. In the left pane, under Administer, click Manage Users > Permission Sets. The Permission Sets page displays the list of existing permission sets.

2. Click New. The Create page is displayed.

3. Enter permission set information such as Label, API Name, and Description.

4. Under Select the type of users who will use this permission set, make sure that None is selected in the License drop-down list.

5. Click Save.

The permission set is created.

4. Add Permissions to the Permission Set

1. Scroll down to the System section.

2. Click the System Permissions link.

3. Next to System Permissions, click Edit. The edit view of the permissions set is displayed.

4. Make sure the following permissions are selected:

   • API Enabled: To access any Salesforce.com API.

   • Manage Encryption Keys: To manage tenant secrets.

   • Modify Metadata Through Metadata API Functions: To synchronize certificates.

   • View Event Log Files: To run reports.

   • View Roles and Role Hierarchy: To view roles and role hierarchy.

   • View Setup and Configuration: To get list of SFDC organizations and their details.

5. Scroll up the page.

6. Click Save. The Permission Changes Confirmation dialog box is displayed.

7. Click Save to confirm the changes.

5. Assign the User to the Permission Set

1. At the top of the page, click Manage Assignments. The Assigned Users page of the permission set is displayed.

2. Click Add Assignments. The All Users page displays the list of existing users.

3. Select the user created in 2. Create a New User.

4. Click Next.

5. Click Assign. The permission set is assigned to the selected user.

6. Click Done.

The user assigned to the permission set is displayed in the list of assigned users.

6. Create a Connected App

Create a new Connected App or use an existing one. If you are using an existing App, then remove any profiles currently assigned to the Connected App and assign the permission set created in 3. Create a New Permission Set. This section describes steps to create a new Connected App.

1. In the left pane, under Build, click Create > Apps. The Apps page shows the list of available apps. On this page, you can create a new Connected App.

2. Navigate to the Connected Apps section. Scroll down the page if needed.

3. Click New. The New Connected App page is displayed.

4. Specify the Basic Information, for example, the app’s name, logo, and contact information. The mandatory fields are:

   • Connected App Name: A unique name for your Connected App. The name can only contain underscores and alphanumeric characters. The name must begin with a letter, not include spaces, not end with an underscore, and not contain two consecutive underscores.

   • API Name: A name for the connected API. It is populated automatically with the Connected App Name you specified above. Change the API name if you want.

   • Contact Email: A valid email address.

   You can also specify additional (optional) details such as contact phone number, URLs, and description.

5. Under API (Enable OAuth Settings):

   1. Select Enable OAuth Settings. More fields are displayed.

   2. Specify a Callback URL, for example, https://localhost.

   3. (Optional but recommended. Applicable to certificate-based authentication.) Select Use digital signatures. This specifies that a digital certificate is used to make API calls to Salesforce. The digital certificate is the public key of an RSA key pair (a public-private key pair) created on the CipherTrust Manager.

      Click Choose File to upload the desired digital certificate (public key). This certificate can be downloaded on the CipherTrust Manager when a connection to the Salesforce cloud is added. Refer to Connection Management for details.

   4. Under Selected OAuth Scopes, select the OAuth scopes to apply to the Connected App. OAuth scopes define permissions for the Connected App that are granted as tokens after the app is authorized. The OAuth token name is in parentheses.

      To select an OAuth scope:

      1. From the Available OAuth Scopes list, select the desired OAuth scope.

         CipherTrust Manager requires the following OAuth scopes:

         • Access the identity URL service (id, profile, email, address, phone)

         • Manage user data via APIs (api)

         • Perform requests at any time (refresh_token, offline_access)

         Use the Ctrl key to select multiple scopes.

      2. Click the Add button (between Available OAuth Scopes and Selected OAuth Scopes sections). The selected OAuth scope moves under the Selected OAuth Scopes section.

      It is recommended to not select the Full access (full) scope.

   5. Make sure that Require Secret for Web Server Flow is selected. This ensures the app’s client secret is required in exchange for an access token.

   6. Clear Require Secret for Refresh Token Flow.

6. Click Save. Changes can take up to 10 minutes to take effect.

7. Click Continue.

When the Connected App is created, the app details are displayed. Note down the Consumer Key, Consumer Secret, and Salesforce username with its password. This information is required when adding a Salesforce connection to the CipherTrust Manager.

To gather this information any time:

1. Log on to your Salesforce cloud account.

2. In the left pane, under Build, click Create > Apps. The Apps page shows available apps.

3. Navigate to the Connected Apps section. Scroll down the page if needed.

4. Click your Connected App to view its details. The Consumer Key and Consumer Secret are displayed under the API (Enable OAuth Settings) section.

On the Add Connection page of the CipherTrust Manager GUI, the Salesforce Consumer Key and Consumer Secret are called Client ID and Client Secret respectively.

Client ID and Client Secret are required for Client Secret as the Authentication type. For Certificate as the Authentication type, only Username and Client ID are required.

7. Add OAuth Policies on Salesforce

Next, you need to specify who all can access the Connected App. This is done by adding appropriate OAuth policy to the Connected App on the Salesforce cloud.

1. In the left pane, under Administer, click Manage Apps > Connected Apps. The Connected Apps page shows the available apps.

2. Under Master Label, click your Connected App. The Connected App Detail page is displayed.

3. Click Edit Policies. The edit view of the Connected App is displayed.

4. Under the OAuth Policies section, from the Permitted Users drop-down list, select Admin approved users are pre-authorized.

   Changing the OAuth policies can cause access deny issues for users currently using the app.

5. Click OK to confirm the action.

6. From the IP Relaxation drop-down list, select an appropriate option. Consult your Salesforce administrator for the appropriate option.

7. Select Refresh token is valid until revoked.

8. Click Save. You are returned to the Connected App Detail page.

8. Assign the Permission Set to the Connected App

1. Scroll down to the Permission Sets section.

2. Click Manage Permission Sets. The Application Permission Set Assignment page is displayed.

3. Select the permission set created in 3. Create a New Permission Set.

4. Click Save.

The selected permission set is assigned to the Connected App.

1. Create a New Profile

1. Log on to your Salesforce cloud account.

2. At the top right, click Setup.

3. In the left pane, under Administer, click Manage Users > Profiles. The Profiles page shows the list of existing profiles.

4. Click New profile. The Clone Profile page is displayed.

5. From the Existing Profile drop-down list, select Minimum Access - Salesforce.

6. Enter Profile Name.

7. Click Save.

The profile is created.

2. Assign Permissions to the Profile

1. Edit the profile.

   The GUI slightly differs for Salesforce production environment and Salesforce Sandbox.

   Click a tab to view details.

   Salesforce Sandbox

   1. Scroll down to the System section.

   2. Click the System Permissions link. The list of permissions assigned to the profile is displayed. These permissions are based on the profile you selected from the Existing Profile drop-down list.

   3. Next to System Permissions, click Edit. The edit view of the profile is displayed.

   4. Make sure the following permissions are selected:

      • API Enabled: To access any Salesforce.com API.

      • Manage Encryption Keys: To manage tenant secrets.

      • Modify Metadata Through Metadata API Functions: To synchronize certificates.

      • View Event Log Files: To run reports.

      • View Roles and Role Hierarchy: To view roles and role hierarchy.

      • View Setup and Configuration: To get list of SFDC organizations and their details.

   5. Scroll up the page.

   6. Click Save. The Permission Changes Confirmation dialog box is displayed.

   Salesforce (Production Environment)

   1. Next to Profile Detail, click Edit. The edit view of the profile is displayed.

   2. Scroll down to the Administrative Permissions section. The list of permissions assigned to the profile is displayed. These permissions are based on the profile you selected from the Existing Profile drop-down list.

   3. Make sure the following permissions are selected:

      • API Enabled: To access any Salesforce.com API.

      • Manage Encryption Keys: To manage tenant secrets.

      • Modify Metadata Through Metadata API Functions: To synchronize certificates.

      • View Roles and Role Hierarchy: To view roles and role hierarchy.

      • View Setup and Configuration: To get list of SFDC organizations and their details.

   4. Under General User Permissions, select View Event Log Files. This is required to run reports.

   5. Scroll up the page.

2. Click Save to confirm the changes.

3. Create a New User

Create a new user or edit an existing one to change the profile. This section describes steps to create a new user.

1. In the left pane, under Administer, click Manage Users > Users. The All Users page is displayed.

2. In the middle of the page, click New User. The New User page is displayed.

3. Specify the user details such as first name, last name, alias, email address, username, and nickname.

4. Select the User License that has the Manage Encryption Keys and View Event Log Files system permissions.

5. From the Profile drop-down list, select the profile created in 1. Create a New Profile.

6. Click Save.

The user is created.

4. Create a Connected App

1. In the left pane, under Build, click Create > Apps. The Apps page shows available apps. On this page, you can create a new connected app.

2. Navigate to the Connected Apps section. Scroll down the page if needed.

3. Click New. The New Connected App page is displayed.

4. Specify the Basic Information, for example, the app’s name, logo, and contact information. The mandatory fields are:

   • Connected App Name: A unique name for your connected app. The name can only contain underscores and alphanumeric characters. The name must begin with a letter, not include spaces, not end with an underscore, and not contain two consecutive underscores.

   • API Name: A name for the connected API. It is populated automatically with the Connected App Name you specified above. Change the API name if you want.

   • Contact Email: A valid email address.

   You can also specify additional (optional) details such as contact phone number, URLs, and description.

5. Under API (Enable OAuth Settings):

   1. Select Enable OAuth Settings. More fields are displayed.

   2. Specify the Callback URL, for example, https://localhost.

   3. (Optional but recommended. Applicable to certificate-based authentication.) Select Use digital signatures. This specifies that a digital certificate is used to make API calls to Salesforce. The digital certificate is the public key of an RSA key pair (a public-private key pair) created on the CipherTrust Manager.

      Click Choose File to upload the desired digital certificate (public key). This certificate can be downloaded on the CipherTrust Manager when a connection to the Salesforce cloud is added. Refer to Connection Management for details.

   4. Under Selected OAuth Scopes, select the OAuth scopes to apply to the connected app. OAuth scopes define permissions for the connected app that are granted as tokens after the app is authorized. The OAuth token name is in parentheses.

      To select an OAuth scope:

      1. From the Available OAuth Scopes list, select the desired OAuth scope.

         CipherTrust Manager requires the following OAuth scopes:

         • Access the identity URL service (id, profile, email, address, phone)

         • Manage user data via APIs (api)

         • Perform requests at any time (refresh_token, offline_access)

         Use the Ctrl key to select multiple scopes.

      2. Click the Add button (between Available OAuth Scopes and Selected OAuth Scopes sections). The selected OAuth scope moves under the Selected OAuth Scopes section.

      It is recommended to not select the Full access (full) scope.

   5. Make sure that Require Secret for Web Server Flow is selected. This ensures that the app’s client secret is required in exchange for an access token.

   6. Clear Require Secret for Refresh Token Flow.

6. Click Save. Changes can take up to 10 minutes to take effect.

7. Click Continue.

When the connected app is created, the app details are displayed. Note down the Consumer Key, Consumer Secret, and Salesforce username with its password. This information is required when adding a Salesforce connection to the CipherTrust Manager.

To gather this information any time:

1. Log on to your Salesforce cloud account.

2. In the left pane, under Build, click Create > Apps. The Apps page shows available apps.

3. Navigate to the Connected Apps section. Scroll down the page if needed.

4. Click your connected app to view its details. The Consumer Key and Consumer Secret are displayed under the API (Enable OAuth Settings) section.

On the Add Connection page of the CipherTrust Manager GUI, the Salesforce Consumer Key and Consumer Secret are called Client ID and Client Secret respectively.

Client ID and Client Secret are required for Client Secret as the Authentication type. For Certificate as the Authentication type, only Username and Client ID are required.

5. Add OAuth Policies on Salesforce

Next, you need to specify who all can access the Connected App. This is done by adding appropriate OAuth policy to the Connected App on the Salesforce cloud.

1. In the left pane, under Administer, click Manage Apps > Connected Apps. The Connected Apps page shows available apps.

2. Under Master Label, click your Connected App.

3. Click Edit Policies. The edit view of the Connected App is displayed.

4. Under the OAuth Policies section, from the Permitted Users drop-down list, select Admin approved users are pre-authorized.

   Changing the OAuth policies can cause access deny issues for users currently using the app.

5. Click OK to confirm the action.

6. From the IP Relaxation drop-down list, select an appropriate option. Consult your Salesforce administrator for the appropriate option.

7. Select Refresh token is valid until revoked.

8. Click Save. You are returned to the Connected App Detail page.

6. Assign the Profile to the Connected App

Next, you need to select the appropriate profiles to choose which users have access to this application.

1. Scroll down to the Profiles section.

2. Click Manage Profiles. The Application Profile Assignment page is displayed.

3. Select the profile created in 1. Create a New Profile.

4. Click Save.

The selected profile is assigned to the Connected App.