0

I'm currently working with the SOAP api to login to a separate salesforce instance. For some orgs though, it seems there's IP restrictions and it seems that it's using a different IP address (I'm assuming the source org's IP address). I have the IP address for my network whitelisted, but it seems that the SOAP request isn't using it. Is there any way I can make the SOAP request using my network's IP address so it doesn't get restricted?

1
  • 1
    Welcome to SFSE! Please take a moment to read How to Ask and take the tour. Regarding your statement: I have the IP address for my network whitelisted, but it seems that the SOAP request isn't using it: Including a Minimal, Reproducible Example would be helpful.
    – identigral
    Nov 8, 2022 at 16:52

1 Answer 1

0

You appear to be making a SOAP login() call from some Org A into some other Org B. Presumably, this is being done via Apex code in Org A.

In that situation, your network has nothing to do with the request. The request is being made from one Salesforce IP to another Salesforce IP.

You can try to allow-list the Salesforce IP ranges in the target org, but you need to be aware that

If you are a Hyperforce customer, please note that due to Hyperforce’s ability to rapidly deliver new cloud infrastructure, we expect the manual overhead of maintaining an IP address allowlist to be a significant challenge. For more information, read Retain Uninterrupted Access to Salesforce Services on Hyperforce. If you have a business or compliance need that requires IP allowlists on Hyperforce, contact your account team. Hyperforce IPs are not listed in this article.​​​​​

There's a couple of architectural issues here, though. One is that SOAP login() is inherently insecure and unstable, because you're storing raw credentials. Your access will not survive a password reset, and you risk leaking the credential. The other is that IP allow listing doesn't scale very well and provides limited security.

One strategy you could explore is using OAuth authentication instead of SOAP, and using a policy on the Connected App to relax IP restrictions so that your Org A can use its refresh token to obtain new access tokens into Org B.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .