# Configuring Legacy Authentication The Basic and OAuth 2.0 authentication types are deprecated and will be removed in a future release. SailPoint recommends [External Client Application (ECA) authentication]() for new and existing connections. ## Basic Authentication (Deprecated) The following information is required if the Basic Authentication type is selected. > [!NOTE] > > **Screenshot** > > [![Basic authentication]()]() 1. Enter the fully qualified URL to the root of the Salesforce server in **Salesforce URL**. For example: `http://login.salesforce.com/services/Soap/u/` To find your site's URL, sign in to Salesforce.com, and perform the following: 1. Select **Develop** under the Application heading. 2. Select **API \> Generate Partner WSDL**. 3. Select **Generate**. The URL is located under the *SalesforceService* service name. 2. Enter the Salesforce **Service Account** that has the required permissions. 3. Enter the **Password** that is used to sign in to the managed system. > **Note** > > This is the API user's Salesforce.com password. If the client's IP address has not been added to your organization's allowed list, you must add a security token to your password for OAuth 2.0 authentication. 4. Select **Save**. ## OAuth 2.0 Grant Type: Password (Deprecated) The following information is required if the Password Grant Type is selected. **Prerequisites:** To support the Password grant type, you must create a connected application on the Salesforce system. For more information on creating the connected application, refer to [Create a Connected App]() in the Salesforce documentation. > [!NOTE] > > The linked document is not maintained by SailPoint and is subject to change without notice. After creating the connected application, you can get the Consumer Key and Consumer Secret from the connected application. > [!NOTE] > > **Screenshot** > > [![OAuth 2.0 Password grant type]()]() 1. Enter the Salesforce **Service Account** name with the required permissions. 2. Enter the **Password** used to sign in to the managed system. This is the API user's Salesforce.com password. > **Note** > > If the client's IP address has not been added to your organization's allowed list, you must add a security token to your password for OAuth 2.0 authentication. 3. Enter the Consumer Key and Secret from the Salesforce connected application in **Client ID** and **Client Secret**. Refer to [OAuth 2.0 Authentication Prerequisites](<#oauth-20-grant-type-password-deprecated>) for more information. 4. Select **Save**. ## OAuth 2.0 Grant Type: JWT (Deprecated) The following information is required if the JSON Web Token (JWT) Grant Type is selected. > [!NOTE] > > **Screenshot** > > [![OAuth 2.0 JWT grant type]()]() 1. Enter the Salesforce username in **Subject**. 2. Enter the OAuth Client ID for the connected application for which you registered the certificate in **Issuer**. 3. Enter the recipient for which the JWT is intended in **Audience**. 4. Enter the **Private Key** to be used to assert the JWT. For information on generating the JWT assertion, refer to [Generating a JWT Assertion](<#generating-a-jwt-assertion>). > **Note** > > The private key should be in standard PKCS \#1 format. Currently, SailPoint doesn't support private keys in PKCS \#8 format. 5. Enter the **Private Key Password** for the Private Key. > **Note** > > This is only needed if the Private Key is encrypted with a passphrase. 6. Select **Save**. > [!NOTE] > > Additional JWT Header and JWT Payload can be added with the `additionalJwtHeader` and `additionalJwtPayload` attributes, respectively, using the REST API if required per the managed system. > > For information on the REST APIs, refer to [Authentication]() and [Update Source (Partial)]() in the SailPoint Developer Community. ### Generating a JWT Assertion Perform the following steps in Salesforce to generate a JWT Assertion: 1. Construct a JWT header with the following format: `{"alg":"RS256"}` Encode the header with **Base64url**. 2. Construct a **JSON Claims Set** for JWT with the following parameters and encode with **Base64url**: - **iss** - The issuer must contain the OAuth client\_id for the connected app for which you registered the certificate. - **aud** - The audience identifies the authorization server as an intended audience. The authorization server must verify that it is an intended audience for the token. Use the authorization server's URL for the `aud` if you are using the following values: `https://login.salesforce.com` `https://test.salesforce.com` or use the following if you are implementing for a community. `https://community.force.com/customers` - **sub** - The subject must contain the username of the Salesforce user or the Salesforce community user if implementing for a community. For backward compatibility, you can use principal (`prn`) instead of subject (`sub`). If both are specified, `prn` is used. - **exp** - The validity must be the expiration time of the assertion within 3 minutes, expressed as the number of seconds from 1970-01-01T0:0:0Z measured in UTC. The following is an example for **JSON Claim Set** for JWT. ```text {"iss": "3MVG99OxTyEMCQ3gNp2PjkqeZKxnmAiG1xV4oHh9AKL_rSK.BoSVPGZHQ ukXnVjzRgSuQqGn75NL7yfkQcyy7", "sub": "my@email.com", "aud": "https://login.salesforce.com", "exp": "1333685628"} ``` 3. Create a string for the encoded JWT Header and the encoded JWT Claims Set in this format. `encoded_JWT_Header + "." + encoded_JWT_Claims_Set` 4. Download the **X509** Certificate from JKS. 5. Sign the resulting string using **RSA SHA256**. 6. Create an Assertion string in the following format. `existing_string(Created in step 3) + "." + base64_encoded_signature` - API request to generate Access Token from JWT assertion: ```text POST /services/oauth2/token HTTP/1.1 Host: login.example.com Content-Type: application/x-www-form-urlencoded grant_type= urn:ietf:params:oauth:grant-type:jwt-bearer& assertion=eyJpc3MiOiAiM01WRz...[omitted for brevity]...ZT ``` ## OAuth 2.0 Grant Type: Refresh Token (Deprecated) The following information is required if the Refresh Token Grant Type is selected. > [!NOTE] > > **Screenshot** > > [![OAuth 2.0 Refresh Token grant type]()]() 1. Enter the Consumer key and secret from the Salesforce connected application in **Client ID** and **Client Secret**. For more information, refer to [OAuth 2.0 Authentication Prerequisites](<#oauth-20-grant-type-password-deprecated>). 2. Enter a non-expiring Salesforce **Refresh Token**. 3. Select **Save**. ### Generating a Refresh Token Perform the following steps in Salesforce to generate the refresh token: 1. In Salesforce, create a **New Connected App**. Consider the following as you configure the new connected app: - Salesforce generates a **Consumer Key** and **Consumer Secret** that can be found in **Manage Consumer Details**. Retain these for this process as you'll use them for the `client_id` and `client_secret` entries respectively. - Enter `https://login.salesforce.com/` as the **Callback URL**. This will be used later in this process. 2. Generate an authorization code that will be used to generate a refresh token. 1. Copy the URL below and substitute your values for the `Consumer Key` and the `Callback URL`: ```text https://login.salesforce.com/services/oauth2/authorize?response_type=code&client_id=&redirect_uri= ``` 2. Paste the modified URL into your browser and navigate to the page, then authenticate as needed. Select **Allow** to authorize access. After authorizing, the browser redirects you to the Callback URL you configured in the New Connected App. Note the authorization code appended to it. For example: `https://login.salesforce.com/?code=` If you have any issues generating the authorization code, ensure that **Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows** is disabled in the Connected App in the Salesforce source. > **Important** > > You may need to URL-decode the authorization code before using it in the next step. 3. Generate a refresh token using the authorization code in POSTMAN. - **method** - POST - **URL** - `https://login.salesforce.com/services/oauth2/token` - **Body** - Add the following: ```text grant_type=authorization_code client_id= client_secret= code= redirect_uri= ``` You will receive the refresh token in the response this request returns. 4. (*Optional*) To test the refresh token, you can generate an access token. Create an API request to generate an access token using the refresh token as follows: ```text POST /services/oauth2/token HTTP/1.1 Host: login.salesforce.com client_id= client_secret= grant_type=refresh_token refresh_token= ``` ## OAuth 2.0 Grant Type: Client Credentials (Deprecated) The Salesforce SaaS connector supports the Client Credentials grant type for authentication. > [!NOTE] > > **Screenshot** > > [![OAuth 2.0 Client Credentials grant type]()]() To configure the client credentials grant type: 1. In the **Client ID** field, enter the Consumer Key from the Salesforce source. 2. In the **Client Secret** field, enter the Consumer Secret from the Salesforce source. 3. Select **Save**.