7

As we can read in many other questions here Connected Apps used by and used in combination with a Managed Package actually don't need to be created in the customer org (e.g. by using Metadata API) OR go as metadata into the Managed package (would make it super hard to create multiple dev orgs).

I need the Connected App so external Java Application at dynamic endpoints needs to connect to my Managed Package and modify data using the Standard REST-API.

And the App needs to pass Security Review. So it somewhat needs to conform to official Salesforce recommendations.

Then where do I create the connected App and how do I reference it in the Managed package? Or is this even the wrong question?

Improve this question
2
  • 1
    Went through this whole process over the past couple months - my understanding is that it must be in the org that will have the final Managed Package. You can create a different connected app in a different org for testing/stage/UAT purposes that will have a different set of keys
    – Brian Miller
    Commented Jul 17, 2019 at 12:23
  • 1
    I would recommend using OIDC dynamic client registration. You create a "parent" connected app and then each subscriber/customer org will send a client reg request (via code you'd write..). This scheme would only make sense if the "parent" connected app resides in some non-customer org...but I don't know if that will work with a managed package and/or pass security review.
    – identigral
    Commented Jul 17, 2019 at 15:28

1 Answer 1

Reset to default
5

You create the Connected App in some permanent org that you control. In most cases, it doesn't need to be installed or created in the customer org. (If, for example, you were planning to JWT auth into a customer org and wanted to use admin-preapproved Profiles or Permission Sets, that metadata does have to exist there, but if you just need the Client Id and Client Secret, it's not needed).

If you're using the Connected App in the Managed Package to make connections into some Salesforce org, including the one it's installed in, you'll have to ship your secret values in the package, which you can shield in Protected Custom Settings or Custom Metadata. If the Connected App is for the use of an external component of your app (e.g., a web service that authorizes into customer orgs), you shouldn't need to ship any components at all.

Improve this answer
2
  • I need the Connected App so external Java Application at dynamic endpoints need to connect to my Managed Package and modify data using the Standard REST-API.
    – Robert Sösemann
    Commented Jul 17, 2019 at 12:32
  • 1
    @RobertSösemann You shouldn't need to ship any metadata, in that case. However, I've never gone through Security Review with an app that included an external component, so I don't know what they're going to ask of you.
    – David Reed
    Commented Jul 17, 2019 at 12:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .