Managing a Key Broker for Salesforce Service

Once you have created a Key Broker for Salesforce service, you can view information on the service, and all tenant secrets, whether generated through Salesforce or through DPoD. You can also change the status of some tenant secrets, and generate a new tenant secret to replace the current secret.

The Salesforce limit on how often you can generate a data tenant secret (once every 24 hours in production orgs and developer orgs, once every 4 hours in sandbox environments) is also in place for tenant secrets generated by DPoD. If DPoD loses access to Salesforce you can restore it with To reauthorize Salesforce access.

View service information

1. Navigate to your service through View Services (My Services for application owners). Click the service name.

2. View the service configuration. The following settings are displayed:

   DPoD Settings:

   • Service Name
   • Service Type
   • Created
   • Created by

   Salesforce settings:

   • Salesforce Username
   • Salesforce Instance URL
   • Salesforce User ID
   • Salesforce Organization ID
   • Salesforce Display Name

3. View the listed Tenant Secrets. The following attributes of each secret are displayed:

   • Status - Indicates the tenant secret`s capabilities.
   • Active - Can be used to encrypt or decrypt data. Only one secret can be active at a time.
   • Archived - Cannot encrypt new data. Can decrypt data previous encrypted with this secret when it was active. You can revoke an Archived secret in the Actions column, which destroys the secret in Salesforce only.
   • Destroyed - Cannot encrypt or decrypt data. Data encrypted with this secret when it was active cannot be decrypted. This indicates that the secret was destroyed in Salesforce and a copy is not stored in DPoD.
   • Revoked - Cannot encrypt or decrypt data. This secret displays as Destroyed in Salesforce. However, this secret still exists on DPoD, and you can change the status from Revoked to Archived in the Actions column.
   • Version - The version number of the secret.
   • Type - This refers to the kind of data the tenant secret encrypts. Options include: Data, Analytics, Search Index, Deterministic.
   • Created At - Date and time the tenant secret was generated. Timestamp in format Day-Month-Year time in 24-hour notation.
   • Created By - Username of the Salesforce user who created the tenant secret.
   • Last Modified At - Date and time the tenant secret was modified. Timestamp in format Day-Month-Year time in 24-hour notation.
   • Modified by - Username of the Salesforce user who modified the tenant secret.
   • Actions - Actions you can perform on the secret.
   • Revoke - change a secret's status from Archived to Revoked. This deletes the secret from Salesforce, but retains a copy in DPoD.
   • Restore - change a secret's status from Revoked back to Archived. This restores the DPoD copy back to Salesforce.

Generate a new tenant secret

1. Navigate to your service through View Services (My Services for application owners). Click the service name.

2. Click Generate Secret.

3. Select the type(s) of secret you would like to generate by enabling the checkboxes. Salesforce allows for one active secret of each type, so you can replace any of the active Data, Analytics, Search index, or Deterministic secrets. Your Salesforce organization must have Analytics and Deterministic secret types enabled to generate those secret types.

   This new secret replaces the current active secret, and appears in the DPoD tenant secret list, as well as in the Salesforce interface. The previously active secret appears as "Archived".

Delete the service

1. If you are viewing a service's details, click the Delete button in the upper right corner.

   If you are viewing the service list on the View Services page (My Services for application owners), click the trash can icon in the Actions column for the service you wish to delete.

   A confirmation dialog displays.

2. Confirm the deletion by entering the service name and clicking Delete.

Reauthorize Salesforce access

1. Navigate to your service through View Services (My Services for application owners). Click the service name.

   Under tenant secrets a message is displayed indicating that DPoD has lost access to the Salesforce account.

2. Click the Reauthorize Access button.

   A dialog displays indicating that you will be brought to Salesforce.

3. Click the Go to Salesforce button.

4. Log in to Salesforce. You may connect with the original account associated with the service, or another user account within the same organization. If your Salesforce account requires two-factor authentication, you are prompted at this point to verify the identity.

5. You are asked to allow account access. If the listed permissions are "Access your basic information", "Access and manage your data", and "Perform requests on your behalf at any time", click Allow.

   You are returned to DPoD, and your tenant secrets are displayed in the table.