Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

We want to store some integration passwords in Salesforce so that it can be accessible when we access that system. Just trying to understand what approach we should take to store these credentials in salesforce.

FYI - I am aware of encrypted fields in SFDC (but looking if there is any other options).

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I've handled a similar situation in the past through a combination of text/text area custom fields, apex and visualforce.

The text/textarea is used to store an encrypted version of the data. The visualforce page allows the user to type in the secret key that is used to view or save that data, and the apex controller actually carries out the encrypt before storing against the record and the decrypt when retrieving.

The reason I went that route is I didn't want every administrator to be able to access the plaintext data, which encrypted fields will allow. The downside is that if the secret key is forgotten or mislaid, its not possible to decrypt the data, so you need to make sure you have a process in place to manage the key.

The actual Apex is pretty straightforward. If these are being used in an automated fashion you could store the key in code, although this means it is still decryptable if someone goes to the effort of writing some additional apex to use the key.

share|improve this answer
    
You can store the key in a custom setting, which if protected and in a managed package, would be unavailable to anyone outside of the packaging org. Using the managed IV options, you can also avoid having to store the IV separately, which overall makes a good fit for keeping secrets secret. –  sfdcfox Nov 6 '13 at 17:28

Aside from using the existing encrypted fields the only option really would be to roll the encryption/decryption yourself, of course given the governor limits at play anything super intensive would be out of the question.

I'd say your best bet is to use those fields, or if possible, leverage OAuth authentication so you're only having to store a valid token.

share|improve this answer
1  
Encryption is built into the platform, so there's no need to try anything "super-intensive"-- you can get AES256 in milliseconds of processing time. –  sfdcfox Nov 6 '13 at 17:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.