New Authorization Mechanism

Intro

The new app authorization mechanism allows us to securely connect 3B Forms, 3B CLM, 3B WFM, 3B Onboarding and 3B Portals & Mobile Apps with Salesforce and the mechanism replaces the old Username + Password + Token mechanism.

The benefits of the new mechanism are:

• If a user's password expires or is reset, the connection would continue to work without disruption
• A more reliable connection and better error messaging
• A server-to-server connection ensures highest level of security
• A single setup for all 3B applications as opposed to a set up per application

Setup

Follow these steps to successfully setup the new authorization mechanism.

Get your My Domain

Go to Setup -> My Domain and copy your "My Domain" which should look something like this: https://customer-name.develop.my.salesforce.com/

Create a Connected App

Go to Setup -> App Manager and click on "New Connected App". Populate the fields as per the table below:

Field	Value
Connected App Name	3B Authorization App
API Name	X3B_Authorization_App
Contact Email	orgs+auth@3b4sf.com
Enable OAuth Settings	true
Callback URL	https://login.salesforce.com (we will change this later)
Selected OAuth Scopes	full, refresh_token, offline_access

Leave all other fields as defaulted.

Hit Save and then click on "Manage Consumer Details" button. Take note of the Consumer Key and Consumer Secret

Create an Auth. Provider

Go to Setup -> Auth. Providers and click on "New". Populate the fields as per the table below:

Field	Value
Provider Type	Salesforce
Name	This Org
URL Suffix	This_Org
Consumer Key	The Consumer Key from the Connected App
Consumer Secret	The Consumer Secret from the Connected App
Authorize Endpoint URL	This is your My Domain + /services/oauth2/authorize
Token Endpoint URL	This is your My Domain + /services/oauth2/token
Default Scopes	refresh_token full

Leave all other fields as defaulted. Hit Save and once the Auth. Provider is created, take note of the Callback URL which will be your My Domain + /services/authcallback/This_Org

Update the Connected App

Go back to the connected app (Setup -> App Manager), and click on "edit" from the drop down menu. Update the Callback URL field (previously with placeholder https://login.salesforce.com) to the new Callback URL provided by the This_Org Auth. Provider (i.e. My Domain + /services/authcallback/This_Org).

Create a Named Credential

Go to Setup -> Named Credentials and create a new Legacy Named Credential. Populate the fields as per the table below:

Field	Value
Label	AuthorizationService
Name	AuthorizationService
URL	Paste the My Domain url here
Identity Type	Named Principal
Authentication Protocol	OAuth 2.0
Authentication Provider	This_Org
Scope	refresh_token full
Start Authentication Flow on Save	true
Generate Authorization Header	true
Allow Merge Fields in HTTP Header	false
Allow Merge Fields in HTTP Body	true

Hit Save and you will be re-directed to the login page for the org. Enter your admin's user's credentials and allow access on the next screen.

Once you have completed this process, you will be re-directed back to the Named Credential. Ensure that the field Authentication Status shows as Authenticated as username@domain.com

Update Custom Settings

By now, you have successfully created a secure connection. We now need to tell the 3B app which Authorization Named Credential to use when connecting to Salesforce. Head over to Setup -> Custom Settings -> 3B Forms (or 3B Portals, or 3B Onboarding or 3B CLM or 3B WFM settings) and click on Manage. Under the field Authorization Named Credential enter "AuthorizationService" (this is the name of the Named Credential we created earlier).

New Installs

For new installations, ensure that the classes (b3o | b3p | b3d | b3f)GlobalRemotingRouter is added to the guest site user.

Video

You can watch this short video that demoes the setup: https://drive.google.com/file/d/1jiVSP_CriAFUopqANkt-KV0i2-JJ61f2/view?usp=sharing

Support

The following app versions implement this new mechanism:

• 3B Portals - v2.4+