3

There is quite a lot of documentation about Salesforce and MFA, but sofar I have not been able to find out how exactly Salesforce is going to enforce MFA.

Why this matters? Well, if you have connected apps, this might be an issue. What I have seen: a connected app requests an OAuth token by supplying a username, password, client id, secret, etc. The user, referred to by the username, has a profile. I have enabled the 'Multi-Factor Authentication for User Interface Logins' permission for the profile. I have not enabled the 'Multi-Factor Authentication for API Logins' permission.

The MFA FAQ states that API login does not require MFA.

However, if I set the Session Security Level of the profile to High Assurance, the connected app can no longer communicate with Salesforce. Error: invalid session id.

This seems to contradict the statement that Salesforce makes here: "The high assurance security setting applies to UI logins. OAuth token exchanges aren’t subject to the requirement. OAuth refresh tokens that were obtained before a high assurance security setting is applied to a profile can still be exchanged for valid API access tokens. Tokens are valid even if they were obtained with a standard assurance session. To require users to establish a high assurance session before accessing the API with an external application, revoke existing OAuth tokens for users with that profile. Then assign a high assurance security setting to the profile. Users must log in with MFA and reauthorize the application."

If I change the security setting back to empty, the interface immediately works again.

Processing identigral's comments and reading Salesforce's documentation, these are the steps that I must take:

"To require users to establish a high assurance session before accessing the API with an external application,

  1. revoke existing OAuth tokens for users with that profile.
  2. Then assign a high assurance security setting to the profile.
  3. Users must log in with MFA and reauthorize the application."

I performed steps 1 and 2. Regarding step 3, I have the following questions:

  • Which user must do this? A sysadmin or the user whose credentials will be used by the connected app?
  • How do I reauthorize the application? I really have no idea.

Regarding those questions: if I look at the Trailhead that covers this topic, it mentions a section called 'OAuth policies'.

So I looked deeper and via App Manager > (app) Manage > Edit Policies, I was able to change the setting to "Admin approved users are pre-authorized" This in turn made it possible to add the profiles of allowed users.

Now it started making sense how a connected app and a profile can be related. Unfortunately, I still have to idea how to reauthorize the application. I have played with all variations of profile sesssion security level, logging in as the appropriate user with MFA, deleting and adding the profile to the connected app policy, but to no avail. If the profile sesssion security level is set to High Assurance, the connected app gets the error INVALID_SESSION_ID, as soon as I set the profile sesssion security level to empty, the connected app has no problems accessing Salesforce.

When I look in Connected Apps OAuth Usage, the connected app is not listed there. Neither does the user, which is used by the connected app to log in, have any filled OAuth loggings/settings. Nothing to revoke or reauthorize there.

The app is an external Enterprise Service Bus, it does not have a user interface with which I can (re)authorize access to Salesforce.

5
  • It's unclear if you performed this step: revoke existing OAuth tokens for users with that profile. Then assign a high assurance security setting to the profile. Users must log in with MFA and reauthorize the application
    – identigral
    Nov 15, 2021 at 15:51
  • I was thinking in that direction, but... I used something like Postman to log in and request an OAuth token. It did not matter what value I chose for profile security setting, I always got the same token in return (I guess the token was not expired in that time frame). And subsequent calls - that use the token - don't use the username anymore, just the token. Which is the same. Also, a connected app is not in any way related to a profile or a user name. So how can I reauthorize a connected app? Nov 15, 2021 at 16:01
  • Revoke token: doc. Uninstall the app: doc . Uninstalling the app implies that it will have to be reauthorized again when you grab a fresh (new) token. Uninstalling it should revoke all issued tokens...but this behavior changed over the years, so YMMV.
    – identigral
    Nov 15, 2021 at 16:13
  • Only revoking the token does not help. I still don't understand how un/reinstalling the app is going to help: its settings do not refer to a profile, so the un/reinstalling process has no knowledge about how/if MFA has been enabled. An additional problem (specific to my circumstances) is that the generation of a new client-id and secret involves the deployment of a new version of the app, which is not trivial. Nov 16, 2021 at 7:47
  • @identigral Is see your remarks at salesforce.stackexchange.com/questions/333318/… For my connected app: it is not listed in Connected Apps OAuth Usage. The connected app is an Enterprise Service Bus, I have no idea how to reauthorize it from within that app. Nov 16, 2021 at 12:21

1 Answer 1

1

This has cost me two days of research, but I finally found out what is going on and I found out that I cannot fix the problem.

It turns out that the connected app, an Enterprise Service Bus, is using the OAuth 2.0 Username+Password flow.

However, according to the Salesforce documentation:

For connected apps, only the OAuth 2.0 refresh token flow, web server flow, and user-agent flows support using API logins with the high assurance MFA session security level. All other OAuth flows [...] block API logins with the high assurance MFA session security level.

This explains why all of my attempts to make MFA work with my particular connected app failed.

Worse: the three OAuth flows that work with MFA are not compatible with an API-only connected app such as an Enterprise Service Bus.

I am going to raise a case with Salesforce Support asking them how they will guarantee that the connected app will continue to work after MFA is enforced. Because there are several ways for Salesforce to do that. And if they choose to do it by changing the profile Session Security level to High Assurance, then this app will fail and all hell will break loose (Salesforce being the single source of truth of client data in our company).

Update: I have raised this issue in the MFA - Getting started Salesforce Trailhead group.

5
  • The flows that require authorization by user can be implemented by a headless service such as an ESB. Good idea? No..but it can be done. SFMC does exactly this for the Core<->SFMC connector.
    – identigral
    Nov 18, 2021 at 7:49
  • @identigral Sounds interesting. Do you have a link to documentation that tells us how to do it? Nov 18, 2021 at 10:44
  • It's standard oAuth stuff but, yes, the devil is in the details. SFMC implements authorization code grant which SF calls web server flow. Any resource owner (ESB being an example) could do this.
    – identigral
    Nov 18, 2021 at 16:40
  • If you haven't done so already, post to Identity or MFA Trailblazer group in addition to opening a case with support. PMs read these.
    – identigral
    Nov 20, 2021 at 18:45
  • 1
    @identigral I had already done that. I have added the link to it in my answer. Nov 22, 2021 at 7:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.