Is Multi Factor Authentication (MFA) supported for configuring the Salesforce Connector?

Requirements

• A Salesforce account of the proper edition is required to connect to the Salesforce API
• Multi Factor Authentication (MFA) for the organisation must be enabled before creating the app that will be used for the authentication via API integration
• User permissions needed to read, create, update, or delete connected apps in Salesforce:
  • Customize Application
  • Modify All Data or Manage Connected Apps

Procedure

1. Sign in to Salesforce .

2. Create a Connected App and set the scopes.

   1. Create a new Connected App.

   2. Enter the required information in Connected App Name, API Name, and Contact Email.

   3. Select Enable OAuth Settings and Enable for Device Flow. Leave the remaining checkboxes on their default values. 

   4. In Selected OAuth Scopes, add the following scopes:

      • Perform requests at any time (refresh_token, offline_access)

      • Full access (full)

   5. Click Save.

3. Generate the Consumer Key and Consumer Secret for the created app. Since you have changed the scopes, you need to regenerate these values for the app.

   1. On the details page for the new app, select Manage Consumer Details.

   2. In Staged Consumer Details, choose Generate. This generates new values.

   3. In Staged Consumer Details, click Apply. This invalidates the current values and adds the new ones to Consumer Details.

   4. Copy the vales for Consumer Key and Consumer Secret. They are used in the following steps, and when adding the connector. Note that the changes can take up to 10 minutes to take effect before you can proceed to Step 4.

4. Request a refresh token with the OAuth2 authentication process.

   1. In the browser where you are signed in to Salesforce, paste the URL replacing <CLIENT_ID> with the copied Consumer Key value.

      https://login.salesforce.com/services/oauth2/authorize?response_type=code&client_id=<CLIENT_ID>&redirect_uri=https://login.salesforce.com/services/oauth2/success
      

   2. Press Enter. An OAuth2 authentication process starts.

   3. Select Continue, and then Allow.

   4. If the authentication is successful, the page shows the message Remote Access Application Authorization.

   5. In the URL for the success message page. locate the value for code= and save it for use in the following step.

      It is the part after code= in the browser URI https://login.salesforce.com/services/oauth2/success?code=....

   6. Run the following command in a command line.

      Use the cURL tool and replace <CODE> with the code copied in Step 4.e, and replace <CLIENT_ID> and CLIENT_SECRET with the copied Consumer Key and Consumer Secret values respectively.

      curl -XPOST 'https://login.salesforce.com/services/oauth2/token?code=<CODE>&grant_type=authorization_code&client_id=<CLIENT_ID>&client_secret=<CLIENT_SECRET>&redirect_uri=https%3A%2F%2Flogin.salesforce.com%2Fservices%2Foauth2%2Fsuccess' 

      Note that each value that's inserted into the URL must be properly encoded. This means when using Postman instead of the cURL tool, you need to decode the copied code first.

   7. In the generated JSON response, copy the value displayed (between the quotation marks) for refresh_token and save it. It is used when adding the connector.

5. When adding the connector, in Settings, enter the values from Salesforce according to the table below:

   Setting	Value from Salesforce
   Client ID	The Consumer Key of the connected app that you created in Salesforce.
   Client secret	The Consumer Secret of the connected app that you created in Salesforce.
   Refresh token	The refresh token that you generated during the authentication process.
   Login URL	The URL of the authorization server. https://login.salesforce.com for production environments - this is the default value https://test.salesforce.com for sandbox environments
   Company names	The legal entities in your organization for which you want to collect data. An asterisk, *, collects data for all domains connected to your organization, including user accounts without email address. This is the default value. One or several domains connected to your organization collects data only for those, and will exclude user accounts without email address. One name per row. If you add both an asterisk and names, the asterisk takes precedence and data is collected for all legal entities. Note when the asterisk is kept in this field, the connector retrieves all subscriptions and users, including third-party accounts that you have given access to your Salesforce instance. If you add company names, the connector imports users only for the specified legal entities. However, the connector imports the total number of assigned subscriptions for your organization from Salesforce, regardless of entered company names. Therefore, if you add company names, there may be a mismatch in the SaaS pages between the number of users and the number of assigned subscriptions for your Salesforce instance.

After completing this task, follow the general procedure to Add connectors.

The connector makes API calls to the vendor to retrieve data.

Please contact Snow Support  for any further assistance.

See Also

• Prepare Salesforce Sales Cloud Connectors
• Salesforce's Help And Training Community documentation