I need to integrate with an external system that cannot fully support OAuth 2.0 server flow, so we're looking at just doing a basic username/password flow.

So, I think I need to set up Named Credentials with an Identity Type of "Per User" and Authentication Protocol of "Password Authentication".

What I want to do is have them press a custom button in the UI that takes them to a custom Lightning Component which does the callout. I'm fine with writing that component and using Named Credentials to merge in the authentication values. But, the first time, they won't have entered their external username/password into SF yet. And the external system forces a password change every 30 days, so they will have to keep updating them in SF.

The question is, how do I then allow users to set their own username/password values? I gather that these end up being stored as an ExternalDataUserAuth but it seems like it can only be set up by getting the user to visit a standard page associated with their profile. I tried creating/updating them from anonymous Apex with something like this:

update new ExternalDataUserAuth(Id = '0XUyyyyyyyyyy',
                               Username = 'aidan',
                               Password = 'foobar');

And got the response:

DML operation Update not allowed on ExternalDataUserAuth

Really, I just want my custom component to try the callout, and if the authentication fails, get them to update the username/password on the SF side without having to leave the custom component.

This seems like such a simple thing, but my research so far has got me nowhere.

  • Have you thought about some sort of SSO instead? They're saved to NamedCredential, and you'll only be able to write to that table using the Metadata API.
    – Adrian Larson
    Apr 16, 2018 at 10:29
  • We were going to do OAuth 2.0 and have Named Credentials handle it all. But developers of the external system have come back late in the project to say they can't do it until they do a major new release of their system. So, I don't think SSO will fly for these circumstances. We're aiming for a simple and quick solution - with a plan to do it properly later. Frustrating. Will check out writing to the tables I want via Metadata API...
    – Aidan
    Apr 16, 2018 at 10:39
  • 1
    I have been down similar paths so searching my posts may be fruitful. For example: Possible to update NamedCredential from Apex?
    – Adrian Larson
    Apr 16, 2018 at 10:50
  • 1
    Actually that seems like a pretty close duplicate. I think it might make sense to close as such.
    – Adrian Larson
    Apr 16, 2018 at 11:27
  • Thanks for the pointers Adrian. I can't believe I missed your post about doing this from Apex. My question is a bit wider - I don't require an Apex solution. I think Im going to try popping up a window with the standard interface for this. If that works, I'll post it as an answer.
    – Aidan
    Apr 17, 2018 at 12:04

1 Answer 1


As Adrian pointed out, it has been established that we can do this from Apex via the Metadata API. That makes it quite a lot of work, though.

Possible to update NamedCredential from Apex?

For my purposes, this is a temporary measure while the external system sorts out doing OAuth 2.0 server flow. So, I query the ExternalDataUserAuth table:

List<ExternalDataUserAuth> existingAuths = [
        SELECT Id
        FROM ExternalDataUserAuth
        WHERE ExternalDataSource.Name = :systemName
        AND UserId = :UserInfo.getUserId()

If there is one, I pop up a window like this:

window.open('/' + component.get('v.externalDataUserAuthId') + '/e', 'Enter Login Details', 'width=900,height=600');

If there is no existing ExternalDataUserAuth record, you can just use ExternalDataUserAuth.getSObjectType().getDescribe().getKeyPrefix() instead of the Id to create one.

It takes a bit of user-training to explain this (and we give them information before popping up the window), but this seems like a good easy solution for now.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .