Salesforce Connector

The Salesforce connector lets you provision, reconcile, and synchronize users between Salesforce and the Identity Cloud managed user repository.

This chapter describes how to install and configure the Salesforce connector, and how to perform basic tests to ensure that it's running correctly.

Before You Configure the Salesforce Connector

The instructions in this chapter assume that you have an existing Salesforce organization, a Salesforce administrative account, and a Connected App with OAuth enabled.

For instructions on setting up a Connected App, see the corresponding Salesforce documentation. When you have set up the Connected App, locate the Consumer Key and Consumer Secret. You will need these details to configure the connector.

The Salesforce connector is bundled with Identity Cloud and has no specific installation requirements.

Configure the Salesforce Connector

The easiest way to configure the Salesforce connector is through the Admin UI:

Configure the Salesforce Connector Through the UI
  1. Log in to the Admin UI at https://localhost:8443/admin (substitute localhost for the host on which your Identity Cloud instance is running).

  2. Select Configure > Connectors, and click New Connector.

  3. Enter a Connector Name (for example, Salesforce) and select Salesforce Connector - 1.5.20.2-RC1 as the Connector Type.

  4. Supply the Login URL, Consumer Key, Consumer Secret and click Save.

    The Login URL is the OAuth endpoint that will be used to make the OAuth authentication request to Salesforce.

    Note

    When you create your connected app, you are instructed to wait 2-10 minutes for the settings to propagate across all the Salesforce data centers. If you are using a Salesforce test tenant, such as https://eu26.lightning.force.com, you can specify a custom URL here and enter the FQDN of the test tenant. This lets you test the connector without waiting for the new app settings to be propagated.

  5. Select Save to update the connector configuration.

    The connector now attempts to access your Salesforce organization.

    Enter your Salesforce login credentials.

    On the permission request screen click Allow, to enable Identity Cloud to access your Salesforce Connected App.

  6. When your connector is configured correctly, the connector displays as Active in the UI.

Implementation Specifics

  • For PATCH requests, a connector can potentially add, remove, or replace an attribute value. The Salesforce connector does not implement the add or remove operations, so a PATCH request always replaces the entire attribute value with the new value. Salesforce does not support multi-valued attributes.

  • Attributes themselves cannot be removed from Salesforce. The connector therefore performs an update with "" as the value of the attribute being removed. This sets the value of the removed attribute to null.

    Note

    Salesforce does not support application user DELETE requests.

  • The Salesforce connector supports any Salesforce object that is available to the API. To check which objects are available, log in to Salesforce Workbench to access the API explorer. This URL points to Version 49 of the API. Adjust the URL for the latest API version.

    Because the number of Salesforce objects is potentially very large, the Salesforce connector configuration includes a supportedObjectTypes property that lets you specify the objects you want to support. The connector checks the metadata in Salesforce for each of the objects you list in this property, and dynamically builds the required schema. The sample connector configuration file (provisioner.openicf-salesforce.json) generates the schema only for the User object:

    {
        ...
        "configurationProperties": {
            ...
            "supportedObjectTypes": [
                "User"
            ]
        },
    }    

    You can add any object to the list of supportedObjectTypes, and the connector will build the schema for that object.

  • The Salesforce API restricts how query results can be paged. The default, and maximum page size is 2000. The minimum page size is 200. The Salesforce API does not guarantee that the requested page size is the actual page size. Returned results might vary, to maximize performance.

    For example, the following query (with "pageSize=1") might return more than one user if more than one user exists in Salesforce:

    https://tenant-name.forgeblocks.com/openidm/system/salesforce/user?_queryId=query-all-ids&_pageSize=1

    For more information, see the Salesforce documentation.

OpenICF Interfaces Implemented by the Salesforce Connector

The Salesforce Connector implements the following OpenICF interfaces.

Create

Creates an object and its uid.

Delete

Deletes an object, referenced by its uid.

Schema

Describes the object types, operations, and options that the connector supports.

Script on Connector

Enables an application to run a script in the context of the connector. Any script that runs on the connector has the following characteristics:

  • The script runs in the same execution environment as the connector and has access to all the classes to which the connector has access.

  • The script has access to a connector variable that is equivalent to an initialized instance of the connector. At a minimum, the script can access the connector configuration.

  • The script has access to any script-arguments passed in by the application.

Search

Searches the target resource for all objects that match the specified object class and filter.

Sync

Polls the target resource for synchronization events, that is, native changes to objects on the target resource.

Test

Tests the connector configuration. Testing a configuration checks all elements of the environment that are referred to by the configuration are available. For example, the connector might make a physical connection to a host that is specified in the configuration to verify that it exists and that the credentials that are specified in the configuration are valid.

This operation might need to connect to a resource, and, as such, might take some time. Do not invoke this operation too often, such as before every provisioning operation. The test operation is not intended to check that the connector is alive (that is, that its physical connection to the resource has not timed out).

You can invoke the test operation before a connector configuration has been validated.

Update

Updates (modifies or replaces) objects on a target resource.

Salesforce Connector Configuration

The Salesforce Connector has the following configurable properties.

Basic Configuration Properties Properties

PropertyTypeDefault Encrypted [a] Required [b]
clientId String null

The client identifier

clientSecret GuardedString null

The secure client secret for OAUTH

refreshToken GuardedString null

The refresh token for the application

loginUrl String https://login.salesforce.com/services/oauth2/token

The endpoint from which a new access token should be queried (https://login.salesforce.com/services/oauth2/token)

instanceUrl String null

The URL of the Salesforce instance (such as https://example-com.cs1.my.salesforce.com)

version double 48.0

The Salesforce API version

connectTimeout long 120000

The maximum connection timeout

proxyHost String null

The hostname of an http proxy, used between the connector and the Salesforce service provider

proxyPort Integer 3128

The proxy port number, if an HTTP proxy is used between the connector and the Salesforce service provider

maximumConnections int 10

The maximum size of the HTTP connection pool

supportedObjectTypes String[] []

Defines a list of Salesforce objects that will be used to dynamically build the provisioner schema

proxyUri String null

The URI of an HTTP proxy that contains the scheme, host, and port number for that proxy

proxyUsername String null

The proxy username to use with a proxy that requires authentication

proxyPassword GuardedString null

The proxy user password to use with a proxy that requires authentication

[a] Indicates whether the property value is considered confidential, and therefore encrypted in OpenIDM.

[b] A list of operations in this column indicates that the property is required for those operations.

Read a different version of :