Set up a Salesforce connector

This is an updated and improved version of the Salesforce connector! If you’re setting up Salesforce with ConductorOne for the first time, you’re in the right place.

Availability

ConductorOne only integrates with the Salesforce editions with API access: Salesforce Enterprise, Unlimited, Developer, and Performance editions. You cannot use this connector successfully with Group or Essentials editions, or with Professional edition without an API add-on. Learn more about which Salesforce editions support API access in the Salesforce documentation.

Capabilities

Resource	Sync	Provision
Accounts*
Groups
Roles
Permission sets
Profiles
Connected apps

The Salesforce connector supports automatic account provisioning. This connector does not support account deprovisioning. You must deprovision accounts directly in Salesforce. *You have the option to sync user accounts that use non-standard licenses.

Gather Salesforce credentials

Configuring the connector requires you to pass in credentials generated in Salesforce. Gather these credentials before you move on.

The owner of a Salesforce user account with a profile that includes the API Enabled and View Setup and Configuration permissions must perform this task.

Enable API access for your Salesforce user

Before you begin, make sure that the Salesforce user who will set up the integration with ConductorOne has a profile that includes the API Enabled and View Setup and Configuration permissions. To edit a profile so that it includes the API Enabled and View Setup and Configuration permissions:

Log into Salesforce as an Administrator.

Click the gear icon and select Setup.

Search for “profiles” and select Profiles from the search results.

In the User Profiles list, locate the user profile you want to add the permission to and click Edit.

Find the Administrative Permissions section of the page and click to select API Enabled and View Setup and Configuration.

Click Save.

Your user’s profile can now access Salesforce APIs.

Locate your Salesforce domain

Log into the Salesforce admin panel and copy the URL from your browser.

ConductorOne integrates with domains that use one of the following Salesforce URL structures:

my.salesforce.com
sandbox.my.salesforce.com
test.salesforce.com
lightning.force.com
develop.lightning.force.com
sandbox.lightning.force.com

That’s it! Next, move on to the connector configuration instructions.

Configure the Salesforce connector

To complete this task, you’ll need:

The Connector Administrator or Super Administrator role in ConductorOne
Access to the set of Salesforce credentials generated by following the instructions above

Cloud-hosted
Self-hosted

Follow these instructions to use a built-in, no-code connector hosted by ConductorOne.

In ConductorOne, navigate to Admin > Connectors and click Add connector.

Search for Salesforce v2 and click Add.

Choose how to set up the new Salesforce connector:

Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)
Add the connector to a managed app (select from the list of existing managed apps)
Create a new managed app

Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.

Click Next.

Find the Settings area of the page and click Edit.

Select your method of authenticating to Salesforce and click either OAuth or Username and password.

If you chose OAuth:

In the Domain field, enter your Salesforce domain.
Optional. Check the box to tell ConductorOne to use Salesforce usernames as the email addresses for your organization’s accounts. This option is especially helpful if your organization uses multiple service accounts that all share a noreply@salesforce.com email address.
Optional. Check the box if you want the connector to sync connected apps.
Optional. Uncheck the box if you do not want to sync deactivated users.
Optional. Check the box if you want the connector to sync users on non-standard licenses, such as external users.
Optional. Create a map of the Salesforce license types used by your organization and the profile associated with each license type that has the fewest permissions. ConductorOne will use this information when deprovisioning user profiles to automatically reassign the user to the least-privilege profile associated with their license type.
Click Save.
Click Login with OAuth.
Log in and authorize ConductorOne with your Salesforce instance.
You will then be redirected back to the Salesforce setup page in ConductorOne, where you’ll see an authorization message.

If you chose Username and password:

Enter your Salesforce username and password in the top two fields.
Enter your Salesforce security token in the Security token field. If trusted IP is configured on your user, entering this token is optional. If needed, refer to Reset Your Security Token in the Salesforce documentation.
In the Domain field, enter your Salesforce domain.
Optional. Check the box to tell ConductorOne to use Salesforce usernames as the email addresses for your organization’s accounts. This option is especially helpful if your organization uses multiple service accounts that all share a noreply@salesforce.com email address.
Optional. Check the box if you want the connector to sync connected apps.
Optional. Uncheck the box if you do not want to sync deactivated users.
Optional. Check the box if you want the connector to sync users on non-standard licenses, such as external users.
Optional. Create a map of the Salesforce license types used by your organization and the profile associated with each license type that has the fewest permissions. ConductorOne will use this information when deprovisioning user profiles to automatically reassign the user to the least-privilege profile associated with their license type.
Click Save.

The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

That’s it! Your Salesforce connector is now pulling access data into ConductorOne.

Follow these instructions to use the Salesforce connector, hosted and run in your own environment.When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with ConductorOne, automatically syncing and uploading data at regular intervals. This data is immediately available in the ConductorOne UI for access reviews and access requests.

Step 1: Set up a new Salesforce connector

In ConductorOne, navigate to Connectors > Add connector.

Search for Baton and click Add.

Choose how to set up the new Salesforce connector:

Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)
Add the connector to a managed app (select from the list of existing managed apps)
Create a new managed app

Click Next.

In the Settings area of the page, click Edit.

Click Rotate to generate a new Client ID and Secret.Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Salesforce connector deployment:

Secrets configuration

# baton-salesforce-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-salesforce-secrets
type: Opaque
stringData:
  # ConductorOne credentials
  BATON_CLIENT_ID: <ConductorOne client ID>
  BATON_CLIENT_SECRET: <ConductorOne client secret>
  
  # Salesforce credentials
  BATON_INSTANCE_URL: <Salesforce domain>
  BATON_SALESFORCE_PASSWORD: <Password to the Salesforce account>
  BATON_SALESFORCE_USERNAME: <Username for the Salesforce account>
  BATON_SECURITY_TOKEN: <Salesforce security token (optional if trusted IP is configured)>

  # Optional: include if you want ConductorOne to provision access using this connector
  BATON_PROVISIONING: true

  # Optional: include if you want to sync access to connected apps
  BATON_SYNC_CONNECTED_APPS: true

  # Optional: include if you DO NOT want to sync deactivated users (default = true)
  BATON_SYNC_DEACTIVATED_USERS: false

  # Optional: include if you want to sync accounts that use non-standard licenses
  BATON_SYNC_NON_STANDARD_USERS: true

  # Optional: include to use Salesforce usernames as the email addresses for your organization's accounts
  BATON_USER_USERNAME_FOR_EMAIL: true

  # Optional: include to provide info on how to manage least privileged profile changes 
  BATON_LICENSE_TO_LEAST_PRIVILEGED_PROFILE_MAPPING: <[map]>

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-salesforce.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-salesforce
  labels:
    app: baton-salesforce
spec:
  selector:
    matchLabels:
      app: baton-salesforce
  template:
    metadata:
      labels:
        app: baton-salesforce
        baton: true
        baton-app: salesforce
    spec:
      containers:
      - name: baton-salesforce
        image: ghcr.io/conductorone/baton-salesforce:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-salesforce
        envFrom:
        - secretRef:
            name: baton-salesforce-secrets

Step 3: Deploy the connector

Create a namespace in which to run ConductorOne connectors (if desired), then apply the secret config and deployment config files.

Check that the connector data uploaded correctly. In ConductorOne, click Applications. On the Managed apps tab, locate and click the name of the application you added the Salesforce connector to. Salesforce data should be found on the Entitlements and Accounts tabs.

That’s it! Your Salesforce connector is now pulling access data into ConductorOne.

Troubleshooting the Salesforce integration

When I try to log in with OAuth, I see a “This feature is not currently enabled for this user” error

Salesforce returns this error if the user who is logging in with OAuth does not have permission to access the Salesforce APIs:

{"code":2, "message":"error getting info from connectorClient: [simpleforce] Error. http code: 403 Error Message:  This feature is not currently enabled for this user. Error Code: FUNCTIONALITY_NOT_ENABLED"}

If you see this message, follow the instructions to Enable API access for your Salesforce user and then try logging in again.

Welcome

Build connectors

Configure connectors

Deploy connectors

Upload connector data

Connector library

Availability

Capabilities

Gather Salesforce credentials

Enable API access for your Salesforce user

Locate your Salesforce domain

Configure the Salesforce connector

Step 1: Set up a new Salesforce connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

Troubleshooting the Salesforce integration

When I try to log in with OAuth, I see a “This feature is not currently enabled for this user” error

Welcome

Build connectors

Configure connectors

Deploy connectors

Upload connector data

Connector library

​Availability

​Capabilities

​Gather Salesforce credentials

​Enable API access for your Salesforce user

​Locate your Salesforce domain

​Configure the Salesforce connector

​Step 1: Set up a new Salesforce connector

​Step 2: Create Kubernetes configuration files

​Secrets configuration

​Deployment configuration

​Step 3: Deploy the connector

​Troubleshooting the Salesforce integration

​When I try to log in with OAuth, I see a “This feature is not currently enabled for this user” error

Availability

Capabilities

Gather Salesforce credentials

Enable API access for your Salesforce user

Locate your Salesforce domain

Configure the Salesforce connector

Step 1: Set up a new Salesforce connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

Troubleshooting the Salesforce integration

When I try to log in with OAuth, I see a “This feature is not currently enabled for this user” error