5

Subject: Salesforce API Access Change for Connected Apps

You are receiving this communication because we have identified you as a system administrator of an organization with users that currently leverage a subset of connected apps and have profiles with the "API Enabled" permission turned off

...

We regularly review Salesforce architecture, and as part of this routine review, we identified a subset of connected apps* that were not following the "API Enabled" user permission for the Enterprise, Unlimited, and Performance Editions.

This behavior resulted in users being granted API access regardless of profile settings, creating the opportunity for them to have broader access than explicitly granted. We have no evidence that customers were negatively impacted by this behavior.

...

Seems like a pretty big security hole and some really bad code on Salesforce's part; am I missing something? Why would they send out the alert before fixing the issue?

1
  • I got a few of these today. They say the effective date was yesterday, so they DID notify after the change. Sep 11 '14 at 21:39
6

I'd recommend reading the extra details that appear in the Knowledge Article: API Access Change for Connected Apps.

The change affects the following Salesforce connected apps:

  • Salesforce1 downloadable apps for iOS and Android devices
  • Salesforce for Outlook
  • Connect for Outlook
  • Connect for Office

They have also identified a subset of connected apps created by partners that are affected. The list is in the attachment on the linked knowledge article.

It would appear that specific apps that had been added to an "API whitelist" for access to Professional, Group and Contact Manager editions.

we found that API calls originating from these approved endpoints were not following the “API Enabled” user permission for editions that do support API access (Enterprise, Unlimited, and Performance editions).

This behavior resulted in users being granted API access regardless of profile settings, creating the opportunity for them to have broader access than explicitly granted. We have no evidence that customers were negatively impacted by this behavior.

So these approved apps (that had been through security review) would allow a user without API access to work with the whitelisted apps against an Enterprise, Unlimited or Performance edition org regardless of their "API Enabled" setting on the profile permission.

1

I would assume that the notification was sent so that you could verify the permissions associated with your Connected Apps, in case you had erroneously though you had your perms correct, but didn't, thereby breaking your app by the patch.

2
  • 1
    Actually, the permissions is with the user, not the app, as having it off affects all apps the user uses.
    – sfdcfox
    Sep 11 '14 at 21:49
  • That's what I meant, having it off gave every user access to the app, regardless. I assume that the notice was sent out so that you could check your perms and verify who needed access had it, because some people may get disabled by the patch.
    – greenstork
    Sep 11 '14 at 21:53
1

For you all's visibility if you don't have it already. We believe this issue is also impacting the Workbench giving users direct access to the workbench tool. We checked on the profiles that have API Enabled but they do not have the Workbench box checked but those profiles can still access the Workbench.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.