I'm working on a managed package that we want to publish on the AppExchange. The application has an integration (using a Oauth2) with another salesforce instance.
In source instance, i have created a ReadOnly access user.
I tried with below option but everytime it fails with in security review:
- Hardcoded controller class with username and password along-with Consumer secret key.
- Tried to create protected custom setting for username and password and called the value in controller.
- Tried to create blank protected custom setting and for value defaulted to username and password, post installation it will create a record in custom setting.
tried username and password in protected custom metadatatype.
Tried to uses Named credential and Auth. provider for Oauth2-- In this cases when the managed package is installed by all client org, they need to have username and password shared to them, which is not the part of plan.