0

I'm working on a managed package that we want to publish on the AppExchange. The application has an integration (using a Oauth2) with another salesforce instance.

In source instance, i have created a ReadOnly access user.

I tried with below option but everytime it fails with in security review:

  1. Hardcoded controller class with username and password along-with Consumer secret key.
  2. Tried to create protected custom setting for username and password and called the value in controller.
  3. Tried to create blank protected custom setting and for value defaulted to username and password, post installation it will create a record in custom setting.

  4. tried username and password in protected custom metadatatype.

  5. Tried to uses Named credential and Auth. provider for Oauth2-- In this cases when the managed package is installed by all client org, they need to have username and password shared to them, which is not the part of plan.

Improve this question
1
  • Did you get any feed back from Salesforce on why your security reviews failed?
    – Folkert
    Feb 24, 2017 at 14:47

1 Answer 1

Reset to default
0

Have you looked at custom meta data types? Those can be packaged and set to protected (updateble only by installing an updated package), so the end user does not have to worry about managing passwords and secret keys.

https://help.salesforce.com/articleView?id=custommetadatatypes_package_install.htm&type=0

Be sure to also read the Considerations for Custom Metadata Type Packages https://help.salesforce.com/articleView?id=custommetadatatypes_req_managed_pkgs.htm&type=0&language=en_US&release=206.9

Improve this answer
1
  • Sorry but tried with metadata type too.. it doesn't pass through review.
    – Pat
    Feb 24, 2017 at 14:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .