6

I'm working on a deployment where I am using the new format for Named Credentials with an External Credential. On my external credential, I am using a custom Authentication Protocol with three authentication parameters underneath permission set mapping. When I deployed from the source environment, the parameters did not deploy to the target environment.

When reviewing the underlying xml, it looks like this:

    <?xml version="1.0" encoding="UTF-8"?>
    <ExternalCredential xmlns="http://soap.sforce.com/2006/04/metadata">
        <authenticationProtocol>Custom</authenticationProtocol>
        <externalCredentialParameters>
            <parameterName>my_permission_set_WnQvjgP1666628587620</parameterName>
            <parameterType>NamedPrincipal</parameterType>
            <principal>my_permission_set</principal>
            <sequenceNumber>1</sequenceNumber>
        </externalCredentialParameters>
        <label>MyExternalCredential</label>
    </ExternalCredential>

But on the ExternalCredential documentation it looks like it should be shaped like this when pulled through the metadata API:

<ExternalCredential xmlns="http://soap.sforce.com/2006/04/metadata">
    <label>SampleExternalCredential</label>
    <authenticationProtocol>AwsSv4</authenticationProtocol>
    <externalCredentialParameters>
        <parameterName>Principal</parameterName>
        <parameterType>NamedPrincipal</parameterType>
        <principal>SamplePermissionSet</principal>
        <sequenceNumber>1</sequenceNumber>
    </externalCredentialParameters>
    <externalCredentialParameters>
        <parameterName>AwsService</parameterName>
        <parameterValue>iam</parameterValue>
        <parameterType>AuthParameter</parameterType>
    </externalCredentialParameters>
    <externalCredentialParameters>
        <parameterName>AwsRegion</parameterName>
        <parameterValue>us-east-1</parameterValue>
        <parameterType>AuthParameter</parameterType>
    </externalCredentialParameters>
</ExternalCredential>

Is there an additional metadata type I need to pull to ensure that the permission set mappings for the external credential are included? Or is it by design that the credentials would need to be manually updated in each target environment?

6
  • What version is your API? Oct 26, 2022 at 20:31
  • Also what command or tool you are using to retrieve the metadata? Oct 26, 2022 at 21:00
  • 1
    I am using API 56 Oct 26, 2022 at 21:00
  • 1
    I am using ANT (metadata API) to pull. We would use Copado, but our version of copado currently doesn't support the ExternalCredential metadata type. Oct 26, 2022 at 21:02
  • 1
    Nothing elegant, I had to manually update them each environment. Feb 13, 2023 at 19:02

3 Answers 3

8

As of V58.0, you can't deploy External Credential Principal Access for either Permission Sets or Profiles

For example, the Metadata API for PermissionSet allows for the deployment of:

  • applicationVisibilities. e.g. CustomApplication access
  • classAccesses e.g. ApexClass access
  • ...
  • userPermissions e.g. Run Reports

But no External Credential Principal Access.

As you noted in your comments, you need to deploy manually.


UPDATE: Metadata API V59.0 resolved this issue. no need to deploy manually if you use MDAPI V59.0 or higher

4

Starting v59 and greater, you can make use of externalCredentialPrincipalAccesses directly to package and deploy for permission sets. Here is how we will package the 'External Credential Principal Access':

<?xml version="1.0" encoding="UTF-8"?>
<PermissionSet xmlns="http://soap.sforce.com/2006/04/metadata">
<label>SamplePermissionSet</label>
<externalCredentialPrincipalAccesses>
<enabled>true</enabled>
<externalCredentialPrincipal>test-pu</externalCredentialPrincipal>
</externalCredentialPrincipalAccesses>
</PermissionSet>

Be advised, here the value of externalCredentialPrincipal tag is formatted like this:

<ExternalCredentialName>-<ExternalCredentialParameterName>

So, according to example, ExternalCredentialName is 'Test' and ExternalCredentialParameterName is 'pu'.For profiles, it is manual thing at the moment.

Shoutout to Somya Srivastava for this post on the Known Issues board.

1

Access to the Principals under an External Credential is managed by SetupEntityAccess. Take a look at this developer guide for some examples of using Apex to grant access by creating these records.

You may also want to look into the possibilities around retrieving and deploying SetupEntityAccess, since it would encompass a much wider range of access rules i.e. anything you can tie to a Permission Set.

1
  • SetupEntityAccess is not a Metadata type - not sure how this would be possible
    – cropredy
    Jun 29, 2023 at 17:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .