Issue with decryption using the key in a protected custom setting

Question

I'm working on an app with a base managed package and two extension packages. I need to encrypt a user-entered password as a part of post-installation setup (done right after the base package is installed). The extension packages have batch classes which decrypt this password and make API calls using it. I initially created a "protected" custom setting in the base package to save the key (so that the clients who install our app wouldn't be able to access it). But the batch classes in the extension packages couldn't decrypt the password and the API calls were failing. So I had to use a "public" custom setting to save the key. The batch classes in the extension packages can decrypt the password now, but the key would be visible to the client users (which I don't want). Can anybody please suggest me a better way to handle this issue? Thanks in advance.

Answer 1

You extension packages will NOT be able to access any custom setting that is protected and part of the base package as the namespaces are different.

In addition, if you are storing Salesforce Passwords then you will not be able to pass security review (Just FYI) regardless of if you are storing them encrypted in a custom setting. In this case, what you can do is store an oAuth refresh token.

The only way I can see to do this would to hard code the Key in your packages so that you will be able to decrypt the data in any package.

If you want to make the custom setting a little more invisible:

1. Protect the custom setting
2. Create a global method that returns the value of the protected custom setting - this way is can be called via the extension package

The global method would be visible to the user if they viewed the class but they would not see the custom setting so they would have to do a little more work.