4

Premise

We're currently storing the following parameters used for integration with a home grown web service:

  • username
  • password
  • tokenKey
  • initVector

The below code is used to generate an authentication token:

HttpToken token = new HttpToken();
Blob key = Blob.valueOf(tokenKey);
Blob vector = Blob.valueOf(initVector);
String strToken = token.encryptToken(userName, passwd, key, vector);

Map<String, String> headerMap = new Map<String, String>();
headerMap.put('X-Auth-Token', strToken);
headerMap.put('Content-Type', 'application/json;charset=UTF-8');

HttpToken is a custom class that tokenizes the username, password and uses the Salesforce Crypto methods to perform an AES128 encryption.

Question How can I store the key and vector along with the username, password in a secure manner instead of relying on custom settings?

1 Answer 1

1

You can't. Named Credentials can only store two credential material (e.g. username, password) or an OAuth token (refresh_token, access_token). Custom homebrewed authentication isn't directly supported, so if you need this level of information, you're going to have to go about it manually. Note that you can encrypt custom setting or custom metadata values, so it's not as bad as you think it is. See Secure Secret Storage for more information.

4
  • I think I'll end up using Named Credential for username/password and retain the custom settings for the cryptoKey and vector
    – LVS
    May 19, 2020 at 16:43
  • follow up: this is something that I'm building for an org that doesn't have a namespace or can even create packages. The secure storage options you described are a no-go in that case. I also tried to see if I can store just the username, password in the named credential but I cannot use merge fields because I need to encrypt the u/p before the Http.send()
    – LVS
    May 20, 2020 at 19:51
  • @VidL You can encrypt the data in the fields and/or limit Custom Settings access to certain profiles.
    – sfdcfox
    May 20, 2020 at 20:28
  • only with Shield, I believe? I am able to create Classic Text (Encrypted) fields on objects but not on custom settings
    – LVS
    May 21, 2020 at 12:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .