How to use a Named Credential for custom authentication that needs more than username, password to generate a secure token(X-Auth-Token)?

Question

Premise

We're currently storing the following parameters used for integration with a home grown web service:

• username
• password
• tokenKey
• initVector

The below code is used to generate an authentication token:

HttpToken token = new HttpToken();
Blob key = Blob.valueOf(tokenKey);
Blob vector = Blob.valueOf(initVector);
String strToken = token.encryptToken(userName, passwd, key, vector);

Map<String, String> headerMap = new Map<String, String>();
headerMap.put('X-Auth-Token', strToken);
headerMap.put('Content-Type', 'application/json;charset=UTF-8');

HttpToken is a custom class that tokenizes the username, password and uses the Salesforce Crypto methods to perform an AES128 encryption.

Question How can I store the key and vector along with the username, password in a secure manner instead of relying on custom settings?

Answer 1

You can't. Named Credentials can only store two credential material (e.g. username, password) or an OAuth token (refresh_token, access_token). Custom homebrewed authentication isn't directly supported, so if you need this level of information, you're going to have to go about it manually. Note that you can encrypt custom setting or custom metadata values, so it's not as bad as you think it is. See Secure Secret Storage for more information.