I have seen at least one major consulting firm (and have heard of another) develop custom authentication solutions on top of Communities that enabled external users to access data within an org, without purchasing additional licenses. Basically they marked the objects public, then applied individual-based filters at run-time to mimic private sharing. An Integration User was used to perform the actual work, just like a typical integration. These were cost-saving portal-like solutions that didn't require SSO or any profile-based feature.

Is this against the MSA? Here is the section in question:

3.4 Usage Restrictions. Customer will not (a) make any Service or Content available to anyone other than Customer or Users, or use any Service or Content for the benefit of anyone other than Customer or its Affiliates, unless expressly stated otherwise in an Order Form or the Documentation, (b) sell, resell, license, sublicense, distribute, make available, rent or lease any Service or Content, or include any Service or Content in a service bureau or outsourcing offering, (c) use a Service or Non-SFDC Application to store or transmit infringing, libelous, or otherwise unlawful or tortious material, or to store or transmit material in violation of third-party privacy rights, (d) use a Service or Non-SFDC Application to store or transmit Malicious Code, (e) interfere with or disrupt the integrity or performance of any Service or third-party data contained therein, (f) attempt to gain unauthorized access to any Service or Content or its related systems or networks, (g) permit direct or indirect access to or use of any Services or Content in a way that circumvents a contractual usage limit, or use any Services to access or use any of SFDC intellectual property except as permitted under this Agreement, an Order Form, or the Documentation, (h) modify, copy, or create derivative works based on a Service or any part, feature, function or user interface thereof, (i) copy Content except as permitted herein or in an Order Form or the Documentation, (j) frame or mirror any part of any Service or Content, other than framing on Customer's own intranets or otherwise for its own internal business purposes or as permitted in the Documentation, (k) except to the extent permitted by applicable law, disassemble, reverse engineer, or decompile a Service or Content or access it to (1) build a competitive product or service, (2) build a product or service using similar ideas, features, functions or graphics of the Service, (3) copy any ideas, features, functions or graphics of the Service, or (4) determine whether the Services are within the scope of any patent.

  • No answer given here is going to be a binding legal opinion so you might as well flip a coin. – identigral May 24 '19 at 16:24

Generally speaking, custom authentication schemes against non-user objects (Contacts or a custom object being the most popular) is in violation of the MSA, and may result in retroactive license fees, termination of services and/or partnership status, etc. There are some types of exceptions, such as an integration user capturing leads in to Salesforce, or synchronizing data to an external system that has its own authentication, but specifically "hacking" Communities or Sites to use custom authentication is a big no-no.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.