3

Premise

We're currently storing the following parameters used for integration with a home grown web service:

  • username
  • password
  • tokenKey
  • initVector

The below code is used to generate an authentication token:

HttpToken token = new HttpToken();
Blob key = Blob.valueOf(tokenKey);
Blob vector = Blob.valueOf(initVector);
String strToken = token.encryptToken(userName, passwd, key, vector);

Map<String, String> headerMap = new Map<String, String>();
headerMap.put('X-Auth-Token', strToken);
headerMap.put('Content-Type', 'application/json;charset=UTF-8');

HttpToken is a custom class that tokenizes the username, password and uses the Salesforce Crypto methods to perform an AES128 encryption.

Question How can I store the key and vector along with the username, password in a secure manner instead of relying on custom settings?

0

You can't. Named Credentials can only store two credential material (e.g. username, password) or an OAuth token (refresh_token, access_token). Custom homebrewed authentication isn't directly supported, so if you need this level of information, you're going to have to go about it manually. Note that you can encrypt custom setting or custom metadata values, so it's not as bad as you think it is. See Secure Secret Storage for more information.

| improve this answer | |
  • I think I'll end up using Named Credential for username/password and retain the custom settings for the cryptoKey and vector – Vid L May 19 at 16:43
  • follow up: this is something that I'm building for an org that doesn't have a namespace or can even create packages. The secure storage options you described are a no-go in that case. I also tried to see if I can store just the username, password in the named credential but I cannot use merge fields because I need to encrypt the u/p before the Http.send() – Vid L May 20 at 19:51
  • @VidL You can encrypt the data in the fields and/or limit Custom Settings access to certain profiles. – sfdcfox May 20 at 20:28
  • only with Shield, I believe? I am able to create Classic Text (Encrypted) fields on objects but not on custom settings – Vid L May 21 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.