2

We plan on having a 3rd party vendor doing some production deployments for us. However, we don't want to provide username/password to our production environment at this time.

We're thinking we could have them use Force.com Migration Tool and provide an access token (oauth). I'm assuming I create a connected app/access token for this? If so wouldn't the access token expire fairly quickly which would mean we would have to constantly create access tokens. Or is there another access token I would create for this so it doesn't expire?

Or is there another option instead of using access token or another approach? Bascially, we would like this team deploy to prodcution (visualforce pages, apex classess, etc.) but don't want to provide them username/password at this time.

Thanks

Improve this question
1
  • What would be the difference between providing them credentials for a user and then disabling the user versus drip feeding valid session Ids. Either they have access or they don't.
    – Daniel Ballinger
    Commented Jun 19, 2016 at 8:15

1 Answer 1

Reset to default
1

If you give them a session token of any type with enough permission to deploy code, they will have the ability to (a) query their username, and (b) set their own password, and (c) even set IP restrictions so they can login without security tokens. Instead, you need to invoke the metadata on their behalf. Using just off-the-shelf stuff, you could probably set up a git repository hooked up to Jenkins, and have Jenkins run the deployments. Jenkins can keep the deployments going, and the developers can be isolated to just a git repository. Other solutions are also possible, including custom-built solutions. Finally, you might consider setting up a sandbox with a one-way connection to a master sandbox they cannot log in to. You can keep them isolated from your primary sandboxes and production, yet still give them the power they need to develop.

Improve this answer
3
  • Thanks sfdcfox. Although, I would provide a access token (OAuth) not a session token; ['code']The ID of an active Salesforce session or the OAuth access token['code']
    – user20719
    Commented Jun 19, 2016 at 16:15
  • @user20719 the two are essentially interchangeable. In fact, the force.com cli uses oauth tokens to use the other apis.
    – sfdcfox ♦
    Commented Jun 19, 2016 at 16:26
  • I see what you mean. If they have access to a connected app they can use anything to access SF; this wouldn't just give them access to migration tool but almost anything. Then they would have 'deploy' permissions which would give them high permissions as you mention. I like the idea of Jenkins, Ill try that. Thanks!
    – user20719
    Commented Jun 19, 2016 at 16:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .