0

I'm working on a managed package that we want to publish on the AppExchange. The application has an integration (using a Oauth2) with another salesforce instance.

In source instance, i have created a ReadOnly access user.

I tried with below option but everytime it fails with in security review:

  1. Hardcoded controller class with username and password along-with Consumer secret key.
  2. Tried to create protected custom setting for username and password and called the value in controller.
  3. Tried to create blank protected custom setting and for value defaulted to username and password, post installation it will create a record in custom setting.
  4. tried username and password in protected custom metadatatype.

  5. Tried to uses Named credential and Auth. provider for Oauth2-- In this cases when the managed package is installed by all client org, they need to have username and password shared to them, which is not the part of plan.

  • Did you get any feed back from Salesforce on why your security reviews failed? – Folkert Feb 24 '17 at 14:47
0

Have you looked at custom meta data types? Those can be packaged and set to protected (updateble only by installing an updated package), so the end user does not have to worry about managing passwords and secret keys.

https://help.salesforce.com/articleView?id=custommetadatatypes_package_install.htm&type=0

Be sure to also read the Considerations for Custom Metadata Type Packages https://help.salesforce.com/articleView?id=custommetadatatypes_req_managed_pkgs.htm&type=0&language=en_US&release=206.9

  • Sorry but tried with metadata type too.. it doesn't pass through review. – Pat Feb 24 '17 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.