Salesforce

Purpose

Ingests your Salesforce org, users, profiles, roles, permission sets, groups, and connected apps.

Required Fields

SubImage authenticates with the Salesforce client credentials OAuth flow.

Setup Steps

1. In Salesforce Setup, deploy My Domain and note the URL (e.g. https://acme.my.salesforce.com).

2. In App Manager, create a New External Client App (or classic Connected App) and enable OAuth. Set:

   • Callback URL: any valid HTTPS URL. The client credentials flow never uses it, so it can be anything (e.g. https://login.salesforce.com/services/oauth2/callback).
   • OAuth scope: Manage user data via APIs (api).

3. Create a dedicated integration user and a permission set granting API Enabled and View Setup and Configuration (both read-only). Optionally add Manage Users (see the note below on why, and its trade-off). Assign the permission set to the integration user. We recommend a dedicated integration user; do not impersonate an admin.

4. Enable the client credentials policy: on the app's OAuth policies, enable the Client Credentials Flow and set Run As to the integration user.

5. Read the app's Settings / OAuth Settings and map it to the SubImage fields:

   OAuth Settings field	SubImage field	Notes
   Consumer Key	salesforce_client_id	Required
   Consumer Secret	salesforce_client_secret	Required, secret
   Callback URL	(not used)	Any HTTPS value
   OAuth Scopes	(must include api)	Set in step 2

   The login URL is your My Domain URL from step 1 (salesforce_login_url).

6. In SubImage, fill in salesforce_client_id, salesforce_client_secret, and salesforce_login_url, then save the module.

Notes

• SubImage itself only reads: it runs SOQL SELECT queries and never writes to Salesforce.
• The login URL must be your My Domain URL; login.salesforce.com will not work for the client credentials flow.
• Manage Users is an elevated Salesforce permission (it also grants the ability to create, edit, and deactivate users). It is only needed so the OAuthToken query returns tokens for all users; without it that query is silently limited to the run-as user, producing incomplete authorized-app (connected app) edges. Grant it only if you want complete connected-app coverage and accept the elevated permission; otherwise leave it off and the rest of the sync works normally.