1

I have one app, for this app we need to enter username and passwords and token. The app is working perfectly fine but when uploading in app exchange then security report is not passing it because we are storing username and passwords in custom object.

I have tried below things till now :

  1. Fields are encrypted field.
  2. we are using encryption as well.
  3. I tried with Protected custom setting as well, but after install as managed package , these setting are not visible.
  4. Named Credential i can't use as this is not satisfying my field value.

What is a secure method of storing this information, which will pass a security review?

Improve this question
7
  • Are username and password something you need to update or keep track of for an integration user? If so, do you need to keep track of these for more than one user or only for an API Users?
    – crmprogdev
    Commented Jul 23, 2018 at 11:58
  • Username and passwords are updatable, different user will insert different username and passwords which they have.
    – SalesforceFolks
    Commented Jul 23, 2018 at 11:59
  • Are these the same usernames and passwords as their Salesforce Usernames and Passwords or are they unique to your application?
    – crmprogdev
    Commented Jul 23, 2018 at 12:00
  • they all are unique for the application as they are integrating from 3re party API.
    – SalesforceFolks
    Commented Jul 23, 2018 at 12:02
  • Is there a reason you can't use SSO to your app with Salesforce as the idP and provide the users with the token that you mentioned? The token would be easy to store in a hierarchy custom custom setting that relates to the user's profile.
    – crmprogdev
    Commented Jul 23, 2018 at 12:05

2 Answers 2

Reset to default
6

3- I tried with Protected custom setting as well, but after install as managed package , these setting are not visible.

The Protected Custom Settings are visible to your code but not to the customer. So what you do is create a setup page that asks for the username/password and then the Apex controller saves those values to the Custom Setting. Ensure that after you save the PW to the Custom Setting, it never retrieves the password back to the client side (don't store it in a non-transient variable of an Apex controller; don't include it as the return value of an @AuraEnabled or @RemoteAction method).

Improve this answer
1
4

I recommend you consider implementing SSO with Salesforce as the idP. You could store the token for your app in a hierarchy custom setting (if needed) or simply let the user manage the token in their own browser. The sign on would be initiated by the Salesforce Org that your app is installed in (it would be the idS).

In my opinion, it would seem that your app could be installed as a "connected App". This wouldn't require the org to necessarily have SSO installed in their org, but your Servers would need to be able to do OAuth on your end to accept the Server initiated log-in on the user's behalf via the connected app.

Because many orgs will already be using SSO you'll likely need to obtain your own identity provider for those organizations to interact with via some form of OAuth. This could also include using a social sign-on provider like Google, Facebook and/or Twitter. You can learn more about SSO, Connected Apps and Salesforce Identity along with it's many features from these links:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .