1

We had a person leave the company and need to turndown the user. This person had established the CPQ setup. I am looking to update the user to a dedicated integration user so that quotes, amendments, and renewal quote are no longer created under this person's user record. Please any insight into how to best update this user without disrupting the integration.

I've seen an option of reverting to the legacy amend/renew service, but with this solution comes performance trade-offs.

Update: After some further research I came along a few resources that provided some further guidance on updating the CPQ integration user used for the quote calculation, renewal, and amendment services.

Things to Know About Amendment and Renewal Services

Salesforce CPQ Authorize New Calculation Service best practice

Salesforce CPQ Authorize New Calculation Services

'Salesforce CPQ Integration User (Unmanaged) Permission Set' is initially generated with No Access on Product, causing errors.

1

1 Answer 1

1

After some further research I came along a few resources that provided some further guidance on updating the CPQ integration user used for the quote calculation, renewal, and amendment services.

Things to Know About Amendment and Renewal Services

If you upgraded to Salesforce CPQ in Summer ’19 or later, you’re already using the Large-Scale Amendment and Renewal service. If you upgraded to Salesforce CPQ before Summer ’19, you can switch to the Large-Scale Amendment and Renewal service at any time. In the Salesforce CPQ Subscriptions and Renewals package settings, deselect Use Legacy Amend/Renew Service. The Salesforce CPQ Admin permission set must be assigned to the user who authorized the Salesforce CPQ calculator during package configuration. To identify the user who authorized the Salesforce CPQ calculator, see the knowledge article Salesforce CPQ Authorize New Calculation Service best practice.

Salesforce CPQ Authorize New Calculation Service best practice

In Salesforce CPQ, when clicking the link to Authorize New Calculation Service in the Pricing and Calculation Package Settings, you are generating a token for the user that is clicking the link. This user+token combination will be used by Salesforce CPQ to communicate with a service hosted on Heroku. This application service is used to carry out asynchronous calculations utilizing the Javascript calculator. Without this user+token combination, the system will not be able to perform background calculations. When the calculation service has not been authorized, admins may see the following error on upgrade or installation of Salesforce CPQ:

'Calculation authorization has expired and requires action by an administrator. Go to Salesforce CPQ Settings > Pricing and Calculation and reauthorize the new calculation service.'

Due to this active user requirement, it is recommended that the user that is used to authorize the calculator is a non-human admin user. This will prevent required maintenance and possible downtime if the admin user who authorized the calculator is later deactivated.

Requirements:

  • This non-human user commits calculation results to the database and must have permissions to access the Quote and all related objects (e.g. Quote Line, Quote Line Group, Opportunity, Opportunity Products, Quote Document, etc.).
  • In addition to the Standard and CPQ objects, the user must also have permissions to access all objects that are included in automation such as triggers, workflow rules, and process builders that action upon changes to the above objects.
  • The user must have the Customize Application permission to access the menu to authorize the calculator.
  • You must log in directly as the authorizing user to authorize the Calculation Service. Do not proxy log in to complete authorization.

Resolution: If you have already authorized the calculator and would like to change users, you must first revoke the token by following these steps:

  1. Login to the org as an Admin user.
  2. Navigate to The OAuth Setup > Connected Apps OAuth Usage.
  3. In the "SteelBrick CPQ" line, click the number in the User Count column.
  4. For any user present, click Revoke -- The Calculator will now no longer be authorized. To Authorize as your desired user:
  5. Login to the org as your desired authorizing user for the calculation service.
  6. Navigate to the Salesforce CPQ managed package settings menu (Path: Setup > Installed Packages > Salesforce CPQ > Configure).
  7. Navigate to the "Pricing and Calculation" tab.
  8. Click "Authorize new calculation service".
  9. Click "Allow" in the pop-up, if asked. Note: If during authorization you encounter the error "Oh no, we got an error ", please use an incognito/private browser window and follow the steps "To Authorize as your desired user".

See Also Video - Salesforce CPQ Authorize New Calculation Services

'Salesforce CPQ Integration User (Unmanaged) Permission Set' is initially generated with No Access on Product, causing errors.

Summary

  • On CPQ 242+, installation of Salesforce CPQ defaults 'Use Integration User for Calculations' to True. This triggers calculations as an integration user tied to a Permission Set Group with several Permission Sets.
  • On install, the 'Salesforce CPQ Integration User (Unmanaged)' Permission Set (which is meant to grant standard object access for CPQ) is created without access to the Product Object, which will hit the following error when triggering calculation asynchronously (via Quote or Quote Line records) where Price Rules are Active:
  • Calculation error on quote {Q-xxxxxx}: SBQQ.SecurityUtils.SBSecurityException: You do not have read permission for field Product on object Price Rule.

Steps to Reproduce

  1. Install CPQ in an org.
  2. Create and activate a simple Price Rule.
  3. Create an Opportunity and Quote where Primary = False, add a Product, Save
  4. Check Primary on the Quote to start an async calculation. Observe: Error in Apex Jobs/Logs: Calculation error on quote Q-xxxxxx: SBQQ.SecurityUtils.SBSecurityException: You do not have read permission for field Product on object Price Rule. Please contact your administrator.

Workaround The following steps will re-create the permission set with proper Product access:

  1. Setup > Permission Sets > Delete 'Salesforce CPQ Integration User (Unmanaged)
  2. Navigate to Setup > Installed Package Settings > Pricing & Calculation > make 'Use Integration User for Calculations' False > Save > True > Save
  3. Verify that the CPQIntegrationUserPermSetGroup has a Status of 'Updated'
1
  • 1
    Salesforce has a fairly bad reputation when it comes to link longevity. Is it possible to extract some of the most important points from those articles so that this answer can remain useful when (not if... when) Salesforce decides to break all their links again?
    – Derek F
    Dec 6, 2023 at 19:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .