ClosePlan Named Credentials and Permissions

What are Named Credentials?

Named Credentials were introduced in Salesforce in Spring '15 and provide a reliable and secure way to store sensitive information such as authorization details. Among other features, Named Credentials allow native SFDC applications to use this information without exposing it.

Why does ClosePlan need authorized Named Credentials?

ClosePlan needs an authorized Named Credential (+ Connected App, Auth. Provider) to access other Salesforce APIs such as Metadata, Tooling, and UI APIs.

This ensures that ClosePlan doesn’t need to manage any sensitive information as the entire process is automatically managed by SFDC. It is also the official and only way to access these APIs from within the Salesforce environment.

How are the APIs used?

ClosePlan uses these APIs (Salesforce Metadata API and UI API) to access data that is not accessible with Apex / SOQL.

ClosePlan uses Metadata to read and tweak configurations in a controlled way to prevent User errors.

Examples:

• Retrieving Sales Process details

  • Which Sales Stage belongs to which Sales Process, etc.

• Managing Picklist Values for ClosePlan Objects

  • Whenever a User updates the Relationship Map Picklist Values, several objects are updated at the same time. Additional Metadata related to those Picklist values are also defined.

Authentication with an Integration User

In most Orgs, ClosePlan Named Credentials are authenticated by a User with System Administrator profile. A Sys Admin Profile covers all needed permissions.

Some Orgs prefer to authenticate the Named Credentials with an Integration User. In this case the Integration User must be provided with specific permissions as described below.

Note that by Integration User, we define it as: Any other User with a Salesforce type license that is dedicated to be used for similar scenarios and is not typically represented by an actual User.

Users with special ‘Salesforce Integration User’ licence type cannot be used to authorize Named Credentials.

Minimal Permissions Setup

A User who authorizes a Named Credential needs the following permissions to allow full functionality.

• To authorize Named Credentials:

  • View Setup and Configuration (to get to Named Credentials configuration)

    • View Roles and Hierarchy (dependency)

  • Allows users to modify Named Credentials and External Credentials (to edit Named Credentials)

  • Manage Auth. Providers (Optional if Auth. provider is already selected)

• To access the mentioned APIs

  • API Enabled (to call Meta/UI API)

• To manage metadata:

  • Customize Application

    • Manage Translation (dependency)

    • Manage Custom Permissions (dependency)

  • Modify Metadata Through Metadata API Functions

  • Modify All Data (System Permission, required for Custom Field manipulation)

    • System permission can be replaced by specific object level Modify All permission

      • TSPC__AP_WS_Item__c

Is access to APIs required for ClosePlan to function?

ClosePlan can function without Named Credential authentication, however some Administrative functionality will be prevented such as but not limited to:

• Picklist Values will not be editable

• Field creation will not be permitted, such as attempting to create a Custom Attribute in the ClosePlan Admin

• Additional Administrative limitations can also occur

Workaround 1

For Orgs that cannot allow authentication for Named Credentials to remain active, the following work-around may be an alternative:

• After Installing and configuring the ClosePlan app, and completing all required templates and settings needed for ClosePlan to function as needed, a Sys Admin can remove Named Credential authentication.

• In the event that Administrative work needs to be done on ClosePlan (Such as create a Custom Attribute) Named Credentials can be authenticated temporarily, the work completed and then Named Credential authentication can be removed again.
  
  

Workaround 2

Second option is to reduce User permissions to retain only Read access to the APIs. In such case, ClosePlan will still be able to render various sections, but any attempt to update will fail with error. Note that the ClosePlan application is not aware if all required permissions are provided and errors are expected to occur if not.

Important Points:

• ClosePlan updates and changes ONLY ClosePlan metadata.

• ClosePlan does NOT touch the metadata of the Client organization.

• Named Credentials must be authorized by a User with proper permissions, usually a System Administrator.

• ClosePlan provides no bypass for a Standard User to edit or change Salesforce Metadata through the ClosePlan Admin feature.

  • The User must still have required permissions (usually System Administrator)

    • If the User does not have the required permissions, SFDC/ClosePlan will prohibit the modification of metadata.

Note:

In Salesforce Classic, legacy behavior permits a direct call to metadata APIs. In Lightning, Salesforce changed the behavior to increase security.

Logging Metadata Changes

The SFDC (Audit Trail) metadata logging mechanism still tracks all metadata changes, but operations will be logged on behalf of the User who authorized the named credential. In some cases, they are surrounded by additional logs logged as the actual User, providing additional clues. However, the actual User may be hidden.

External Access to the System

ClosePlan Connected App does NOT provide any access to a Client Org under any circumstances.

In order for the the Connected Application to provide access, a 3rd party would need to have:

• Consumer Key

• Consumer Secret Key

• A User within the system with Login, Password and security token

For any additional questions, please reach out to Technical Success with an email to Support@People.ai