5

Subject: Salesforce API Access Change for Connected Apps

You are receiving this communication because we have identified you as a system administrator of an organization with users that currently leverage a subset of connected apps and have profiles with the "API Enabled" permission turned off

...

We regularly review Salesforce architecture, and as part of this routine review, we identified a subset of connected apps* that were not following the "API Enabled" user permission for the Enterprise, Unlimited, and Performance Editions.

This behavior resulted in users being granted API access regardless of profile settings, creating the opportunity for them to have broader access than explicitly granted. We have no evidence that customers were negatively impacted by this behavior.

...

Seems like a pretty big security hole and some really bad code on Salesforce's part; am I missing something? Why would they send out the alert before fixing the issue?

Improve this question
1
  • I got a few of these today. They say the effective date was yesterday, so they DID notify after the change.
    – Thomas Taylor
    Commented Sep 11, 2014 at 21:39

3 Answers 3

Reset to default
6

I'd recommend reading the extra details that appear in the Knowledge Article: API Access Change for Connected Apps.

The change affects the following Salesforce connected apps:

  • Salesforce1 downloadable apps for iOS and Android devices
  • Salesforce for Outlook
  • Connect for Outlook
  • Connect for Office

They have also identified a subset of connected apps created by partners that are affected. The list is in the attachment on the linked knowledge article.

It would appear that specific apps that had been added to an "API whitelist" for access to Professional, Group and Contact Manager editions.

we found that API calls originating from these approved endpoints were not following the “API Enabled” user permission for editions that do support API access (Enterprise, Unlimited, and Performance editions).

This behavior resulted in users being granted API access regardless of profile settings, creating the opportunity for them to have broader access than explicitly granted. We have no evidence that customers were negatively impacted by this behavior.

So these approved apps (that had been through security review) would allow a user without API access to work with the whitelisted apps against an Enterprise, Unlimited or Performance edition org regardless of their "API Enabled" setting on the profile permission.

Improve this answer
1

I would assume that the notification was sent so that you could verify the permissions associated with your Connected Apps, in case you had erroneously though you had your perms correct, but didn't, thereby breaking your app by the patch.

Improve this answer
2
  • 1
    Actually, the permissions is with the user, not the app, as having it off affects all apps the user uses.
    – sfdcfox ♦
    Commented Sep 11, 2014 at 21:49
  • That's what I meant, having it off gave every user access to the app, regardless. I assume that the notice was sent out so that you could check your perms and verify who needed access had it, because some people may get disabled by the patch.
    – greenstork
    Commented Sep 11, 2014 at 21:53
1

For you all's visibility if you don't have it already. We believe this issue is also impacting the Workbench giving users direct access to the workbench tool. We checked on the profiles that have API Enabled but they do not have the Workbench box checked but those profiles can still access the Workbench.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .