Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

I have been consuming SAP webservices from salesforce using callout mechanism. Currently, i am sending userid in the argument to the webservice to ensure that the call is from a valid salesforce user. But i need to increase the data security and plan to pass machine id or physical machine address as an additional parameter in my callout to the SAP webservice.

The above Userid mechanism would find a match in a user mapping table in SAP, validates it and give access to the data. otherwise error response would be returned.

Question:

How to get machine id or physical machine address in Visualforce page or in Apex?

Any suggestions, please.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

You can use UserInfo.getOrganizationId() to get the "Salesforce.com Organization ID" that is presented in Setup -> Company Profile -> Company Information. That distinguishes the calling org from other orgs.

share|improve this answer
    
Thanks @Keith. But we need to add authorized device ids in a table in SAP so that when a webservice request comes from salesforce, the logic in webservice retrieves the machine or device id and lookup in SAP table. On successful lookup, the webservice gives data response otherwise it gives error response to salesforce. This means that my client wants to give access to SAP data only from users along with their device ids which have been authorized already and stored in SAP table. –  Baskaran S Jun 6 at 12:56
    
If the user access the webservice from salesforce for the first time from an unknown device (i.e., the device id is not yet available in SAP table), he would see an error like "unauthorized access, please contact administrator". Then, the user will send an email to the admin mentioning this issue. On the SAP side, since already this request has been failed and there should be a failure log available, they (SAP Admin or tech support guy) retrieve the machine id from the request and add it their table. They also validate if the admin got a request from the user pertaining to this issue. –  Baskaran S Jun 6 at 13:02
    
@BaskaranS I'm not sure why the Organization ID couldn't serve this purpose as that is a fixed value that can either be pre-setup in SAP or be part of the email process? –  Keith C Jun 6 at 13:05
    
I agree with you @KeithC. I would try to convince the client using this approach. Thanks. –  Baskaran S Jun 6 at 13:23
    
Each instance runs on a cluster, which means that there is no one specific device that runs the service. You'd have to whitelist all of them, and maintain the list every time maintenance occurred or you moved pods. That's assuming salesforce exposed this data to begin with, which they do not. –  sfdcfox Jun 6 at 14:35

You can try to use the information in the HTTP Header (in case you have a request) but the information is not that detailed.

Accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8, Accept-Encoding=gzip, deflate, Accept-Language=en-US,en;q=0.5, CipherSuite=RC4-MD5 TLSv1.2 128-bits, Connection=keep-alive, Host=c.cs17.visual.force.com, Referer=https://cs17.salesforce.com/servlet/servlet.Integration?scontrolCaching=1&lid=00b20000001Enav&eid=0012000000VgOgB&ic=1, User-Agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:29.0) Gecko/20100101 Firefox/29.0, X-Salesforce-Forwarded-To=cs17.salesforce.com, X-Salesforce-SIP=212.35.0.12

You may be able to retrieve the source IP address which is most of the times a router/modem IP. Using this information you can create a Table on the SAP with the allowed IP addresses for each user.

Another suggestion would be to use Apex encrypt / decrypt functionality to add a token in your request, which can be verified on the other side. You can even assign a passkey per user and (stored in Hierarchy Custom settings), encrypt it and send it over with your request. This way you can identify invalid requests. For more details on using the apex Crypto class you can check this

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.