Shine a light on shadow apps

ConductorOne Docs

Salesforce integration

ConductorOne provides identity governance for Salesforce. Integrate your Salesforce instance with ConductorOne to run user access reviews (UARs) and enable just-in-time access requests.

Availability

General availability. The Salesforce integration is available to all ConductorOne users.

ConductorOne only integrates with Salesforce editions with API access. ConductorOne integrates with Salesforce Enterprise, Unlimited, Developer, and Performance editions.

You cannot use this integration successfully with Group or Essentials editions, or with Professional edition without an API add-on.

Learn more about which Salesforce editions support API access in the Salesforce documentation.

Capabilities

  • Sync user identities from Salesforce to ConductorOne

  • Resources supported:

    • Groups
    • Roles
    • Permission sets

Set up the Salesforce integration

This task requires either the Integration Administrator or Super Administrator role in ConductorOne.

  1. In ConductorOne, open Admin and click Integrations > Salesforce.

  2. If this is your first Salesforce integration, the integration form opens automatically. Otherwise, click Add connector.

  3. Choose whether to add the new Salesforce connector as a data source to an existing application (and select the app of your choice) or to create a new application.

    Do you SSO into Salesforce using your identity provider (IdP)? If so, make sure to add the connector to the Salesforce app that was created automatically when you integrated your IdP with ConductorOne, rather than creating a new app.

  1. Set the integration owner for this connector. You can manage the integration yourself, or choose someone else from the list of ConductorOne users. Setting multiple integration owners is allowed.

    A Salesforce integration owner must have the following permissions:

    • Integration Administrator or Super Administrator role in ConductorOne
    • A Salesforce user account with a profile that includes the API Enabled permission (this permission is included by default in the Standard User and System Administrator profiles)
  1. Click Create and add details.

Next steps

  • If you are the integration owner, proceed to Integrate your Salesforce instance for instructions on integrating Salesforce with ConductorOne.

  • If someone else is the integration owner, ConductorOne will notify them by email that their help is needed to complete the integration.

Integrate your Salesforce instance

A user with the Integration Administrator or Super Administrator role in ConductorOne and a Salesforce user account with a profile that includes the API Enabled permission must perform this task.

Step 0: Enable API access for your Salesforce user

Before you begin, make sure that the Salesforce user who will set up the integration with ConductorOne has a profile that includes the API Enabled permission. This permission is included by default in the Standard User and System Administrator profiles.

To edit a different profile so that it includes the API Enabled permission:

  1. Log into Salesforce as an Administrator.

  2. Click the gear icon and select Setup.

  3. Search for “profiles” and select Profiles from the search results.

  4. In the User Profiles list, locate the user profile you want to add the permission to and click Edit.

  5. Find the Administrative Permissions section of the page and click to select API Enabled.

  6. Click Save.

Your user’s profile can now access Salesforce APIs, and you’re ready to begin the integration process.

Step 1: Locate your Salesforce domain

  1. Log into the Salesforce admin panel and copy the URL from your browser. We’ll use this in Step 2.

    ConductorOne integrates with domains that use one of the following Salesforce URL structures:

    • my.salesforce.com
    • sandbox.my.salesforce.com
    • test.salesforce.com
    • lightning.force.com
    • develop.lightning.force.com
    • sandbox.lightning.force.com

Step 2: Set up the Salesforce connector

  1. In ConductorOne, open Admin and click Integrations > Salesforce.

  2. In the list of connectors, locate and click on the name of the connector with the Not connected label.

  3. Find the Settings area of the page and click Edit.

  4. In the Domain field, enter the Salesforce domain you looked up in Step 1.

  5. Optional. Check the box to tell ConductorOne to use Salesforce usernames as the email addresses for your organization’s accounts. This option is especially helpful if your organization uses multiple service accounts that all share a noreply@salesforce.com email address.

  6. Click Save.

Step 3: Log in with OAuth

  1. Click Login with OAuth.

  2. Log in and authorize ConductorOne with your Salesforce instance.

  3. You will then be redirected back to the Salesforce integration page in ConductorOne, where you’ll see an authorization message.

  4. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

That’s it! Your Salesforce instance is now integrated with ConductorOne.

Configure the Salesforce integration using Terraform

As an alternative to the integration process described above, you can use Terraform to configure the integration between Salesforce and ConductorOne.

See the ConductorOne Salesforce integration resource page in the ConductorOne Terraform registry for example usage and the full list of required and optional parameters.

Troubleshooting the Salesforce integration

When I try to log in with OAuth, I see a “This feature is not currently enabled for this user” error

Salesforce returns this error if the user who is logging in with OAuth does not have permission to access the Salesforce APIs:

{"code":2, "message":"error getting info from connectorClient: [simpleforce] Error. http code: 403 Error Message:  This feature is not currently enabled for this user. Error Code: FUNCTIONALITY_NOT_ENABLED"}

If you see this message, follow the instructions in Step 0: Enable API access for your Salesforce user and then try logging in again.