| Table of Contents | ||
|---|---|---|
|
What are Named Credentials?
Named Credentials were introduced in Salesforce in Spring '15 and provide a reliable and secure way to store sensitive information such as authorization details. Among other features, Named Credentials allow native SFDC applications to use this information without exposing it.
Why does ClosePlan need authorized Named Credentials?
ClosePlan needs an authorized Named Credential (+ Connected App, Auth. Provider) to access other Salesforce APIs such as Metadata, Tooling, and UI APIs.
This ensures that ClosePlan doesn’t need to manage any sensitive information as the entire process is automatically managed by SFDC. It is also the official and only way to access these APIs from within the Salesforce environment.
How are the APIs used?
ClosePlan uses these APIs (Salesforce Metadata API and UI API) to access data that is not accessible with Apex / SOQL.
...
RetrievingSales Process details
Which Sales Stage belongs to which Sales Process, etc.
Managing Picklist Values for ClosePlan Objects
Whenever a User updates the Relationship Map Picklist Values, several objects are updated at the same time. Additional Metadata related to those Picklist values are also defined.
Authentication with an Integration User
In most Orgs, ClosePlan Named Credentials are authenticated by a User with System Administrator profile. A Sys Admin Profile covers all needed permissions.
Some Orgs prefer to authenticate the Named Credentials with an Integration User. In this case the Integration User must be provided with specific permissions as described below.
...
Users with special ‘Salesforce Integration User’ licence type cannot be used to authorize Named Credentials.
Minimal Permissions Setup
A User who authorizes a Named Credential needs the following permissions to allow full functionality.
...
| Note |
|---|
Note that the actual User working with ClosePlan Admin will still need to have the same permissions, regardless of the fact that they are already granted by the User who authorized the Named Credentials. |
Is access to APIs required for ClosePlan to function?
ClosePlan can function without Named Credential authentication, however some Administrative functionality will be prevented such as but not limited to:
Picklist Values will not be editable
Field creation will not be permitted, such as attempting to create a Custom Attribute in the ClosePlan Admin
Additional Administrative limitations can also occur
Workaround 1
For Orgs that cannot allow authentication for Named Credentials to remain active, the following work-around may be an alternative:
After Installing and configuring the ClosePlan app, and completing all required templates and settings needed for ClosePlan to function as needed, a Sys Admin can remove Named Credential authentication.
In the event that Administrative work needs to be done on ClosePlan (Such as create a Custom Attribute) Named Credentials can be authenticated temporarily, the work completed and then Named Credential authentication can be removed again.
Workaround 2
Second option is to reduce User permissions to retain only Read access to the APIs. In such case, ClosePlan will still be able to render various sections, but any attempt to update will fail with error. Note that the ClosePlan application is not aware if all required permissions are provided and errors are expected to occur if not.
Important Points:
ClosePlan updates and changes ONLY ClosePlan metadata.
ClosePlan does NOT touch the metadata of the Client organization.
Named Credentials must be authorized by a User with proper permissions, usually a System Administrator.
ClosePlan provides no bypass for a Standard User to edit or change Salesforce Metadata through the ClosePlan Admin feature.
The User must still have required permissions (usually System Administrator)
If the User does not have the required permissions, SFDC/ClosePlan will prohibit the modification of metadata.
...
In Salesforce Classic, legacy behavior permits a direct call to metadata APIs. In Lightning, Salesforce changed the behavior to increase security.
Logging Metadata Changes
The SFDC (Audit Trail) metadata logging mechanism still tracks all metadata changes, but operations will be logged on behalf of the User who authorized the named credential. In some cases, they are surrounded by additional logs logged as the actual User, providing additional clues. However, the actual User may be hidden.
External Access to the System
ClosePlan Connected App does NOT provide any access to a Client Org under any circumstances.
...