Salesforce Integration

07/2023

Overview

The Identity Intelligence identity security platform can integrate with your Salesforce instance or instances to capture user account activity. This is valuable in particular for the following reasons -

• Identifying unused Salesforce accounts and reducing unnecessary licensing cost

• Review Salesforce authentication activity and maintain security compliance

• Detect unauthorized access or use of your Salesforce platform

Requirements

The following things are required to configure Salesforce integration with Identity Intelligence:

• A Salesforce admin account

• Licensing - a user account with Salesforce edition of Enterprise or above, due to the requirement for the Web Services API. Developer edition and other lower tier editions will not work for this integration, as the API Only User option is required for the necessary credential flow, and that setting doesn't exist in those tiers.

  
• If access to Salesforce by API is restricted by IP address, please coordinate with your Identity Intelligence representative or contact [e-mail]

Salesforce API Limits

The Identity Intelligence integration for Salesforce will monitor API usage against your Salesforce tenant's daily limit. If the Identity Intelligence detects that the API utilization is within 75% of the Salesforce tenant daily quota, Identity Intelligence will stop any further collection for that day and resume the following day.

Salesforce Configuration

Step 1 - Create API Only User Account

1. The first step in the process is to create an API only user for integration purposes using the Salesforce documentation. Please note:

   • As noted in the Salesforce KB article above, we recommend the user and permission set (if used) have at least a Salesforce license

     
   • The Profile or Permission Set must have API Enabled and API Only User checked in the System Permissions area

     
   • Manage Users permission under the User section is required to collect Login History of all users. Enabling this setting will automatically check a number of other related permissions

     

Step 2 - Set up a Connected App

Create Connected App

1. In Salesforce set up go to Apps --> App Manager and click New Connected App

image

1. Fill in the connected app details, such as Name, Contact email, etc

image

1. Check Enable OAuth Settings

2. Fill in the Callback URL: https://localhost:3000/test/ The Identity IntelligenceIdentity Intelligence API integration does not use an redirects and does not need a functioning callback URL for that purpose.

3. Add Manage user data via APIs scope.

4. Uncheck Require Secret for Web Server Flow and Require Secret for Refresh Token Flow

5. Check Enable Client Credentials Flow

6. Accept the warning:

image

1. Click Save. Click Continue if you see the warning: "Changes can take up to 10 minutes to take effect. Deleting a parent org also deletes all connected apps with OAuth settings enabled."

Get Key and Secret

1. Go back to the App Manager, find the app, Click the Down Arrow and then then View:

image

1. Click "Manage Consumer Details" and go through email two-factor authentication (2FA)

2. Copy the Key and Secret to a temporary location or a key vault of your preference

image

Assign to API user

1. Go back to the App Manager, find the app, Click the Arrow then Manage:

image

1. Click Edit Policies

image

1. At the bottom, under Client Credentials Flow, click the Search button and select the API user.

image

1. Click Save

2. Find your Salesforce URL and save it for use in the next section. This will be under Company Settings -> My Domain

Step 3 - Identity Intelligence Dashboard Configuration

1. Login to your Identity Intelligence Dashboard and go to the Integrations tab

2. Click on Add Integration

3. Click on Add Integration under Salesforce

1. Fill in the details for the Salesforce Integration. Enter the values saved from earlier on in the Salesforce setup:

• Display Name

• Salesforce URL

• Consumer Key

• Consumer Secret

1. Click Save. You will now have a new integration listed on the Integrations page

2. For more details, click on integration name for details

3. You can also click the 3-dot menu drop-down and click Test Connectivity to test the API connectivity with Salesforce

   
4. If you see “Connected!” everything is working

5. Now click the Salesforce integration bar again and click Collect Now to begin the first data collection

   
6. Initial data collection may take up to 24 hours, depending on the size of the environment. Please reach out to [e-mail] with any questions