Why does ClosePlan use Named Credentials?

What are Named Credentials?

Named Credentials were introduced in Salesforce in Spring '15 and provide a reliable and secure way to store sensitive information such as authorization details. Among other features, Named Credentials allow native SFDC applications to use this information without exposing it.

Why are Need?

ClosePlan needs an authorized Named Credential (+ Connected App, Auth. Provider) to access other Salesforce APIs such as Metadata, Tooling, and UI APIs. This ensures that ClosePlan doen’t need to manage any sensitive information as the entire process is automatically managed by SFDC. It is also the official and only way to access these APIs from within the Salesforce environment.

How APIs are used?

CloserPlan uses these APIs to access data that is not accessible with Apex / SOQL.

ClosePlan uses Metadata to read and tweak configurations in a controlled way to prevent user errors.

Examples:

• Retrieving Sales Process details

  • Which Sales Stage belongs to what Sales Process, etc.

• Managing Picklist Values for ClosePlan objects

  • Whenever a User updates the Relationship Map Picklist Values, several objects are updated at the same time. Additional Metadata related to those Picklist values are also defined.

Authentication with an Integration User

In most Orgs, ClosePlan Named Credentials are authenticated by a User with System Administrator profile as it covers all needed permissions.

Some Orgs prefer to authenticate the Named Credentials with an Integration User. In this case the Integration User must be provided with specific permissions as descibed below.

Note that by Integration User, we mean any other user with Salesforce type license that is dedicated to be used for similar scenarios and is not typically represented by an actual user. Users with special ‘Salesforce Integration User’ licence type cannot be used to authorize Named Credentials.

Minimal Persmission setup

A user who authorizes a named credential will need to have the all following permissions to get full functionality.

• To authorize Named Credentials:

  • View Setup and Configuration (to get to NC config)

    • View Roles and Hierarchy (dependency)

  • Allows users to modify Named Credentials and External Credentials (to edit NC)

  • Manage Auth. Providers (Optional if Auth. provider already selected)

• To access the APIs mentioned APIs

  • Api Enabled (to call Meta/UI Api)

• To manage matadata:

  • Customize Application

    • Manage Translation (dependency)

    • Manage Custom Permissions (dependency)

  • Modify Metadata Through Metadata API Functions

  • Modify All Data (required for Custom Field manipulation)

Is access to APIs required for ClosePlan to function?

ClosePlan can function without Named Credential authentication, however some Administrative functionality will be prevented such as but not limited to:

• Picklist Values will not be editable

• Field creation will not be permitted, such as attempting to create a Custom Attribute in the ClosePlan Admin

• Additional Administrative limitations can also occur

Workaround 1

For Orgs that cannot allow authentication for Named Credentials to remain active, the following work-around may be an alternative:

• After Installing and configuring the ClosePlan app, and completing all required templates and settings needed for ClosePlan to function as needed, a Sys Admin can remove Named Credential authentication.

• In the event that Administrative work needs to be done on ClosePlan (Such as create a Custom Attribute) Named Credentials can be authenticated temporarily, the work completed and then Named Credential authentication can be removed again.
  

Workaround 2

Second option is to reduce user permissions to retain only Read access to the APIs. In such case, ClosePlan will still be able to render various setions, but any attempt to update will fail with error. Note that apllication is not aware if all required permissions are provided and errors are expected to occurs if not.

Important Points:

• ClosePlan updates and changes ONLY ClosePlan metadata.

• ClosePlan does NOT touch the metadata of the Client organization.

• Named Credentials must be authorized by the user with propper permissions, usually a System Administrator.

• ClosePlan provides no bypass for a Standard User to edit or change Salesforce Metadata through the ClosePlan Admin feature.

  • The User must still have required permissions (usually System Adminstrator)

  • Otherwise SFDC/ClosePlan will prohibit modification of Metadata.

Note:

In Classic, Salesforce legacy behavior permits a direct call to metadata APIs. In Lightning, Salesforce changed the behavior to increase security.

Logging Metadata Changes

The SFDC (Audit Trail) metadata logging mechanism still tracks all metadata changes, but operations will be logged on behalf of the user who authorized the named credential. In some cases, they are surrounded by additional logs logged as the actual user, providing additional clues. However, the actual user may be hidden.

External Access to the System

ClosePlan Connected App does NOT provide any access to a Client Org under any circumstances.

In order for the the Connected Application to provide access, a 3rd party would need to have:

• Consumer Key,

• Consumer Secret Key

• User within the system with Login, Password and security token

** If a client or prospect requires any further clarification, please open a ticket at Support@People.ai