# Salesforce

## Overview <a href="#overview" id="overview"></a>

The Identity Intelligence identity security platform can integrate with your Salesforce instance or instances to capture user account activity. This is valuable in particular for the following reasons -

* Identifying unused Salesforce accounts and reducing unnecessary licensing cost
* Review Salesforce authentication activity and maintain security compliance
* Detect unauthorized access or use of your Salesforce platform

## Requirements <a href="#requirements" id="requirements"></a>

The following things are required to configure Salesforce integration with Identity Intelligence:

* A Salesforce admin account
* **Licensing** - a user account with Salesforce edition of **Enterprise** or above, due to the requirement for the Web Services API. \
  \
  Developer edition and other lower tier editions will <mark style="color:red;">**not**</mark> work for this integration, as the **API Only User option is required** for the necessary credential flow, and that setting doesn't exist in those tiers.<br>

  <figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2Fz14FrDPeET8KaSleKsiF%2Fimage.png?alt=media&#x26;token=4b406323-923f-4b16-be31-93c5e62d8f85" alt="" width="539"><figcaption></figcaption></figure>
* If access to Salesforce by API is restricted by IP address, please coordinate with your Identity Intelligence representative or open a TAC case

## Salesforce API Limits

The Identity Intelligence integration for Salesforce will monitor API usage against your Salesforce tenant's daily limit. If the Identity Intelligence detects that the API utilization is within <mark style="color:blue;">**75%**</mark> of the Salesforce tenant daily quota, Identity Intelligence will stop any further collection for that day and resume the following day. &#x20;

## Salesforce Configuration <a href="#salesforce-configuration" id="salesforce-configuration"></a>

### Step 1 - Create API Only User Account <a href="#create-api-only-user-account" id="create-api-only-user-account"></a>

1. The first step in the process is to create an [API only user](https://help.salesforce.com/s/articleView?id=000386144\&type=1) for integration purposes using the Salesforce documentation. Please note:

   * As noted in the Salesforce KB article above, we recommend the user and permission set (if used) have at least a **Salesforce** license<br>

   <mark style="color:$danger;">DO NOT USE</mark> the `Minimum Access - API Only Integration` profile or the Salesforce Integration license.  They do not have the necessary permissions to collect the data required by CII. \ <img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FB6BmYRebuQNLPGpmuYoq%2Fimage.png?alt=media&#x26;token=604bcdcf-4a2c-4bfd-909f-29fde9bed189" alt="" data-size="original"><br>

   <figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FDMLtmrSHyj6ud6lq8rih%2Fimage.png?alt=media&#x26;token=793da326-d10e-4380-9128-cd5a7c1baa9b" alt=""><figcaption></figcaption></figure>

   * The Profile or Permission Set must have **API Enabled** and **API Only User** checked in the Administrative Permissions area<br>

     <figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FjoZlqIjcqb7GvQmVWti8%2Fimage.png?alt=media&#x26;token=e613d4ef-3bb1-4b4b-abe9-51a023037ece" alt="" width="563"><figcaption></figcaption></figure>
   * **Manage Internal Users** and **Manage External Users** permission under the User section is required to collect Login History of all users. *Enabling this setting will automatically check a number of other related permissions*<br>

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FdV6OwPcUpA7dtNLYswA8%2Fimage.png?alt=media&#x26;token=2295582a-4221-47b4-8dc3-d39e1867a062" alt=""><figcaption></figcaption></figure>

### Step 2 - Set up a Connected App

#### Create Connected App

1. In Salesforce set up go to **Apps --> External Client App Manager** and click **New External client App**\
   **in the top right corner of the screen**<br>

   <figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FuOwZ7BB09KKHEnisnsQA%2Fimage.png?alt=media&#x26;token=5804f99b-350e-40c4-b809-329afcbf83cb" alt=""><figcaption></figcaption></figure>
2. Fill in the connected app details, such as Name, Contact email, etc
3. Check **Enable OAuth**
4. Fill in the **Callback URL:** [https://localhost:3000/test](https://localhost:3000/test/)/\
   The Identity IntelligenceIdentity Intelligence API integration does not use an redirects and does not need a functioning callback URL for that purpose.
5. Add **Manage user data via APIs** scope.&#x20;
6. *Check* **Enable Client Credentials Flow**<br>

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FfUfyS1IWMzlm7PnyVeiu%2Fimage.png?alt=media&#x26;token=1d7ff6b9-c17b-4f56-bd33-b36ff84a8123" alt=""><figcaption></figcaption></figure>

7. *Uncheck* **Require Secret for Web Server Flow** and **Require Secret for Refresh Token Flow**
8. Click **Create**. Click **Continue** if you see the warning: "Changes can take up to 10 minutes to take effect. Deleting a parent org also deletes all connected apps with OAuth settings enabled."

#### Get Key and Secret

1. On the Settings tab of the new app, under App Settings, click Consumer Key and Secret\ <br>

   <figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FfiA7smdMRvCykvcxqt9D%2Fimage.png?alt=media&#x26;token=0f16d2b1-0008-4670-9d8b-e835329efbd7" alt=""><figcaption></figcaption></figure>
2. Reauthenticate to proceed
3. Copy the Key and Secret to a secure temporary location or a key vault of your preference

#### Assign to API user

1. Go back to the external app and go to the Policies tab.  Click **Edit**
2. At the bottom, under **Oauth Flows and External Client App Enhancements**, click Enable Client Credentials Flow and enter the username / email of the API user account created above.<br>

   <figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FXAgnEN4kWmqpXxkAD32K%2Fimage.png?alt=media&#x26;token=0487d637-2ca3-4198-8171-348c5cc22413" alt=""><figcaption></figcaption></figure>
3. Click **Save**
4. Find your Salesforce URL and save it for use in the next section. This will be under Company Settings -> My Domain

### Step 3 - Identity Intelligence Dashboard Configuration <a href="#oort-dashboard-configuration" id="oort-dashboard-configuration"></a>

1. Login to your Identity Intelligence Dashboard and go to the **Integrations** tab
2. Click on ***Add Integration***
3. Click on ***Add Integration*** under Salesforce

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FH0rFXpHHyaSbMSonjDBp%2Fimage.png?alt=media&#x26;token=0c6156ad-3807-45e9-98af-19d9612b98f5" alt="" width="233"><figcaption></figcaption></figure>

4. Fill in the details for the Salesforce Integration. Enter the values saved from earlier on in the Salesforce setup:

* `Display Name`
* `Salesforce URL`
* `Consumer Key`
* `Consumer Secret`

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FRBBfcKAyObd2PEC8octN%2Fimage.png?alt=media&#x26;token=630b89b0-e252-4cd6-88bc-36d9135b22fa" alt="" width="563"><figcaption></figcaption></figure>

5. Click **Save**. You will now have a new integration listed on the Integrations page
6. For more details, click on integration name for details
7. You can also click the 3-dot menu drop-down and click ***Test Connectivity*** to test the API connectivity with Salesforce<br>

   <figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FVxtvK4xsHzEGC8YnpT24%2Fimage.png?alt=media&#x26;token=ac8120d4-64d2-4376-949d-2cd25b95632f" alt="" width="240"><figcaption></figcaption></figure>
8. If you see “Connected!” everything is working
9. Now click the Salesforce integration bar again and click **Collect Now** to begin the first data collection<br>

   <figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FJsQ5ceVBJxQA2JJdwyYl%2Fimage.png?alt=media&#x26;token=25613790-8fc8-4013-8e4f-ca1cbb137493" alt="" width="231"><figcaption></figcaption></figure>
10. Initial data collection may take up to 24 hours, depending on the size of the environment