3

For a Connected Application if I check 'Relax IP Restrictions' flag then does that mean that all users from my organization would be able to access that application?

So this will only impact the security for that particular app or will this affect anything else?

What exactly are the security implications of this setting?

3

That just means that a user can log in to the specified application regardless of if there are IP restrictions on that users Profile. This would make it so they can only access the standard Salesforce site with whatever IP restrictions are in place for the user, but if they go into the Connected App then they can log in from ANY IP.

This only applies to the specific Connected App that you have edited the settings for.

Keep in mind that Connected Apps use OAuth for authentication. Even if you specify to "Enforce IP restrictions" it will only apply for the initial login. After a user is authenticated to a Connected App they can freely switch IP addresses and their authentication will still refresh with OAuth.

I would typically suggest to just relax IP restrictions unless there is a very strict login policy in place with your organization, and if there is such a strict policy then review OAuth to ensure the refresh behavior is not a concern.

| improve this answer | |
  • I missed a point about "all users" accessing the app. This specific setting is different than the "Permitted Users" settings. You can relax IP policies while still restricting which users can log in to the app. The only way all users will be able to access the Connected App is if the "Permitted Users" setting is set to "All users may self-authorize." – Kalin Jul 13 '15 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.