4

I want to integrate with an external system.

They need to whitelist my IP for permission to use their services.

I looked at this post: https://help.salesforce.com/articleView?id=000321501&type=1&mode=1

to get all the possible IP that my request can have.

In the IP list inside the post above, I took just the RIPE area ( Europe, the Middle East and parts of Central Asia) which is my area, and I sent it to my external service to whitelist it.

The issue:

Just the RIPE section is including ~200K IP addresses.

Salesforce's recommendation is to whitelist ALL the IPs and not just your area which I guess will be like ~1M IP address.

The external service won't whitelist such a number (not even 200K) - They want only one IP Address which I guess is not possible.

We thought to share a key with value in the header request by the method HttpRequest request = new HttpRequest(); request.setHeader('Key',encrypt(Value)); and then, they will check the request by this key and not by this IP.

anyone can share their knowledge about these methods? Dose these recommended?

Is there a way to define one static IP address? even a paid way?

Other solutions will be greatly appreciated.

Thanks!

3

You should not send a key as such in request. Here is how you can do it:

You can use Crypto Class for this scenario. Crypto is an industry standard key creation class.

Steps:

  1. Use EncodingUtil.base64Encode(Crypto.generateAesKey(256)) to generate a unique key. You can save this key in Custom Metadata type and also should be given to your client. Remember that all the further transactions/callouts will happen by using this CryptoKey.

  2. You can encrypt the data using the above key. For this, you have to get the key from metadata-type and then use Crypto.encryptWithManagedIV('AES256', cryptoKey, data); . cryptoKey is the key you saved in metadata-type and data is the sensitive data (in string) you want to send in request-body. After setting the end-point (by using named-credentials) and other headers needed, you can send request.

  3. Client should be able to decrypt the body using a method similar to Crypto.decryptWithManagedIV('AES256', cryptoKey, encryptedData);. Here, cryptoKey is the one which you share with client. You and client will have same key. Without this key, its not possible to decrypt the data. This method is signature in apex but similar method is available in all server languages.

I have used this and perfectly suitable for secure external communication.

For your reference:

Blob cryptoKey = Crypto.generateAesKey(256);
System.debug(EncodingUtil.base64Encode(cryptoKey));  //5id1mTSdc4obMHI1FRf13H3Jgr8YDj8Xl2dP1Teugwk=
Blob data = Blob.valueOf('this is some random text being tested in crypto encrypt');
Blob encrypted = Crypto.encryptWithManagedIV('AES256', cryptoKey, data);
System.debug(EncodingUtil.base64Encode(encrypted));  // 2dqglmXpvpwAfuAH6+GSuxOvhthM69awr+SnrUrGx4qHvRoiNy1tS7rSZFZjFQAsOpBHKlyePmtelHprlMcnWf3SFfvpvKYB/EB0MqXqSaA=
Blob decrypted = Crypto.decryptWithManagedIV('AES256', cryptoKey, encrypted);
String decryptedString = decrypted.toString();
System.debug(decryptedString);  // this is some random text being tested in crypto encrypt
  • If you are sending the key direcly, anybody who is able to read the request in middle will be able to decode the body. Try to speak with them and say its a 1 time key which can be saved in their server. This is how its done for many integrations (for sensitive data) – salesforce-sas Aug 8 at 8:03
  • Hi, What are the disadvantages of using this work-around solution over the IP check? Except for the reason that we both should add some code to encrypt and decrypt the Key...One more thing - The External Service that I'm working with, said that they identify by IP or by Header Key/Value - and that why I asked about sending a key via the Header. Can I use your method to encrypt a key and send it in the Header as a key-value to Identify? I believe that the limitation on the header will need to check also in this case. Thanks a lot. – Salvation Aug 8 at 8:04
  • As you pointed in your question, there are 1M+ IPs, thats big disadvantage. For this encryption, you can create utils class (thats what we did in a project). You can check for other potential solutions, but we found this to be least effort and best results. – salesforce-sas Aug 8 at 8:07
  • Thanks! that helped me a lot. – Salvation Aug 8 at 8:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.