Salesforce Provisioning

Memority's REST connector can provision user accounts in a Salesforce instance through the Salesforce REST API. Some prerequisites must be met on the Salesforce side before accounts can be provisioned.

This page explains how Salesforce provisioning works in Memority and what is required to set it up.

Generic REST connector prerequisites are explained on the REST provisioning page.

Definitions

What is provisioning?

Provisioning automatically creates, updates and deactivates accounts in the target application. It keeps the data consistent between Memority (the authoritative source) and the application (the target).

Once Memority provisions your application, you shouldn't create, modify or deactivate accounts directly in the application. Memority does it for you.

What Salesforce objects can be managed?

The connector manages user accounts (the User object in Salesforce) and the Profile assigned to each user, which determines the user's license.

Can we manage licenses?

Yes. In Salesforce, a user's license comes from the Profile assigned to the user. Licenses are exposed in Memority as Application Dimensions and selected when assigning the role. The connector then sets the matching Profile on the Salesforce account.

Can we manage permission sets, public groups or roles?

Yes, though it is not configured in the plugin. It can be added manually on top of the generated configuration by following the Application Dimensions documentation.

Are accounts deleted in Salesforce?

No. The connector never deletes accounts in Salesforce. When the identity loses its role, or when it is disabled in Memority, the account is deactivated (IsActive=false).

Memority REST connector

API authentication prerequisites

Memority's connector authenticates to Salesforce with the OAuth 2.0 Client Credentials flow, through an External Client App configured on the Salesforce instance. Every API call runs on behalf of a dedicated Run As user, whose permissions define what Memority can do.

Data prerequisites

Creating the permission set

The permissions required by AUTH2 are grouped in a dedicated permission set, which is then assigned to the Run As user.

1. In Salesforce Setup, type "Permission Sets" in Quick Find and open Permission Sets.

2. Click New (not "Create New View").

3. Set the Label (for example Memority Provisioning); the API Name is filled in automatically. Leave Session Activation Required unchecked.

4. Set the License according to the license of the Run As user, or leave --None--. The permissions available in a permission set depend on its license.

5. Click Save.

6. On the permission set page, open System Permissions and click Edit.

7. Check API Enabled and Manage Internal Users.

8. Click Save. If Salesforce displays the list of permission changes and dependencies, click Save again to confirm.

Creating the Run As user

1. In Salesforce Setup, type "Users" in Quick Find, open Users and click New User.

2. Create a dedicated integration user (for example svc.memority@mycompany.com).

3. Choose a User License and a Profile compatible with the permission set created above.

4. Save the user.

5. Open the user and go to the Permission Set Assignments section, then click Edit Assignments.

6. Select the permission set created above in Available Permission Sets, click Add, then Save.

The permission set can also be assigned from the permission set itself: open it, click Manage Assignments, then Add Assignments, select the user and click Assign.

Creating the External Client App

1. In Setup, type "External Client App Manager" in Quick Find, then click New External Client App.

2. Set a name (for example Memority Provisioning), an API name and a contact email. Leave Distribution State set to Local.

3. Under API (Enable OAuth Settings), check Enable OAuth. Set a callback URL: the form requires one even though this flow does not use it, so any valid URL works. Add the OAuth scope Manage user data via APIs (api).

4. Under Flow Enablement, check Enable Client Credentials Flow and confirm. Click Create.

5. Open the Policies tab and click Edit. Under OAuth Policies → OAuth Flows and External Client App Enhancements, check Enable Client Credentials Flow and set Run As (Username) to the integration user. Click Save.

6. Open the Settings tab, expand OAuth Settings and click Consumer Key and Secret. Salesforce may send you a verification code by email. Copy the Consumer Key and the Consumer Secret.

7. In Setup → My Domain, copy the My Domain host of the Salesforce instance (for example mycompany.my.salesforce.com).

8. Send the My Domain host, the Consumer Key and the Consumer Secret of each environment (preprod and prod) to the person who will configure the plugin and the credentials in Memority.

Salesforce can take a few minutes to apply changes to an External Client App. If the first token request fails right after you create the app, wait and retry.

Salesforce Provisioning Plugin

Memority provides a plugin through the MIT Plugin Store that installs and configures the Salesforce Provisioning connector. The plugin generates all the configuration files and data your tenant needs.

Prerequisites

Installation

The plugin is installed with the standard procedure described on the Plugin Store page. Only the information specific to the Salesforce Provisioning plugin is given below.

Installation mode: single installation. The plugin creates a single Salesforce application on the tenant.

Plugin form parameters

The plugin does not restrict the host to the salesforce.com domain.

The plugin always uses HTTPS and version v52.0 of the Salesforce REST API. The generated URLs are set in vars_preprod.properties and vars_prod.properties, where you can change the API version if needed:

• <https://<host>>/services/data/v52.0 for the REST API,

• <https://<host>>/services/oauth2/token for the token endpoint.

External Client App credentials

Create the External Client App credentials manually in the Memority administrator portal, for both preprod and prod. Go to System → Settings → Synchronization Service and create a setting of type CREDENTIAL: sync.connectors.prov-salesforce.credentials (principal: Consumer Key, secret: Consumer Secret).

Data import order

Always import the data in the following order:

1. The application resource of the target environment (resources_pprod_ProvisioningSalesforce.json or resources_prod_ProvisioningSalesforce.json)

2. The roles (roles_ProvisioningSalesforce.json)

3. The license resources (resources_salesforceLicences.json)

What does it do?

The generated configuration works out of the box, but it may need adjustments for specific needs.

The plugin generates the complete configuration required for Salesforce provisioning in just a few clicks.

It manages users (the User object in Salesforce) with a data model that includes first name, last name, email, username, alias, nickname, license (Profile) and activation status. It also generates data you can use right away: one application resource per environment (preprod and prod), one applicative role and four pre-configured licenses.

The plugin supports:

• Account creation, update and deactivation. Updates use PATCH, so fields not managed by Memority are not overwritten. Deactivation sets IsActive=false; the account is never deleted.

• Deactivation when the identity is disabled. If an identity is disabled in Memority while keeping its role, the Salesforce account is deactivated (IsActive=false).

• Reactivation. If the identity is enabled again, or if the role is granted again to an identity whose account was deactivated, the connector finds the existing account by Username and reactivates it (IsActive=true) instead of creating a new one.

• Correlation on Username. The connector searches Salesforce accounts by Username, which is the identity email. Before each update or deactivation, it retrieves the Salesforce Id of the account.

• License management through Application Dimensions. The license is selected when assigning the role. Each license resource stores the name of a Salesforce Profile as its technical ID. At runtime, the connector looks up the matching Profile Id in the target Salesforce instance and sets it on the account. When reading an account, it converts the Profile Id back into its name, so Memority can compare it with the assigned license.

• Account discovery to find orphaned accounts. The task lists all Salesforce users, active and inactive, including technical users created by Salesforce. It runs manually by default and can be scheduled with a CRON expression.

• Rate limiting. The connector sends at most 750 requests per minute. When the provisioning quota is exceeded, it pauses for one minute.

Resolving Profiles adds one API call to each create, update, read and search operation. These calls count toward the daily API limit of the Salesforce instance.

Default licenses

The four default license resources match standard Salesforce Profiles.

The mapping between a license and a Salesforce Profile is defined in the application file (prov-salesforce-rest-application.xml): the technical ID of the license resource is used as the Profile name to look up in Salesforce. The technical IDs must therefore be the exact Profile names, in English.

To use custom Profiles, create or update the license resources so that their technical ID is the exact name of the Profile. See the Application Dimensions page.

Attribute mapping

The time zone, locale, language and email encoding values are defaults, sent only when the account is created and never updated afterwards. You can change them in the CREATE script of prov-salesforce-rest-definition.xml according to your needs.

Technical details

Generated files

Updated files

Troubleshooting

When a Salesforce call fails, the connector writes the HTTP code and the response body returned by Salesforce to the synchronization logs. The Salesforce error code is in the errorCode field of the body. For more detail, turn on logs for the SYNC service in the administrator portal.

Authentication fails with invalid_grant - "no client credentials user enabled"
The Client Credentials flow is not enabled on the External Client App, or no Run As user is set. Check the Policies tab of the app.

Authentication fails with invalid_request - "request not supported on this domain"
The token request does not target the My Domain of the Salesforce instance. Check the Salesforce My Domain host entered in the plugin form.

Authentication fails with invalid_client
The Consumer Key or the Consumer Secret is wrong. Check the sync.connectors.prov-salesforce.credentials setting in the administrator portal.

"Profile '<name>' not found in target org, license resource may need updating"
The technical ID of the selected license resource does not match any Profile name in the target Salesforce instance. Update the license resource with the exact Profile name, as it appears in the Salesforce instance.

Account creation or license change fails with LICENSE_LIMIT_EXCEEDED
The Salesforce instance has no license left for the selected Profile. Free up or buy licenses.

Connection error or timeout
Check the host entered in the plugin form, and check that it is listed in whitelisting.xml.

Account discovery reports technical or inactive accounts as orphans
The discovery lists every Salesforce user, including inactive accounts and technical users created by Salesforce (automated process, integration users…). You can ignore them.

Related documentation

• https://doc.memority.eu/setup-guide/latest/rest-provisioning

• https://doc.memority.eu/setup-guide/latest/memority-plugins