21

Packaging the connected app allows administrators who install the app to control which of their users can use the application. Rather than the coarse ability to block or not block an app (seen in Setup -> Manage Apps -> Connected Apps Oauth Usage), you get the ability to control the security settings for the app in a more finely grained manner (seen in ...


14

I don't think you will need to worry about Canvas App being embedded in your visualforce for passing through lightning ready certification for your application .Since canvas app is essentially a mashup with external system,you don't have to match CSS with lightning design system . For lightning Ready Certification, here are key things SFDC looks in your ...


13

Having been involved in one of those applications, i can say that there was no official list of things they provided, maybe their will be in due course, though the documentation does a pretty good job of describing the features to use. As such having your package make use of one or more of the following Salesforce1 features is going to allow you to be ...


13

Although this post is from last year, I would like to address it since it's apparently coming up in search results for those looking to post unmanaged packages to the AppExchange, and the main answer currently features out-of-date info. To confirm, unmanaged packages are not accepted for security review or posting on the AppExchange. I've put together some ...


12

You cannot create two managed packages in one dev org, you can only have one namespace created per DE org. Your options are to create another DE org and install the first managed package in there. Then, once you start to reference the first managed package in the new DE org, then that package becomes an extension of the first. Once you release your second ...


11

As of now, Salesforce does not do any anti-virus scanning. However, there is an idea here which is under point threshold. Until this is implemented you can use 3rd party apps from AppExchange such as this one.


11

The proper design would be to have the two packages be "extensions" of the core library. This would require all clients to install two packages to use either app, and three packages to use both apps. While slightly more complicated for installs (and possibly undesirable), it would allow you to maintain less code and configuration. Here's how it works: you ...


11

You should be able to sign up for a partner community using your dev org login credentials where you have built the package . https://partnersignup.salesforce.com/partnerLogin You will get access to publishing console once you are in partner community that should help you to publish and manage your listing . You will need an email other than Gmail ...


10

With Enterprise Distribution: You don't need to include UDIDs in your provisioning profile; any device can install the app You must host the IPA somewhere and provide an installation page (could be just a simple link) Apple can and will lay the smack down on you if they suspect you are circumventing the app store If you're not using an Enterprise profile, ...


10

The ability to Compile All Code has been around as long as Apex Code has been a thing. You'll want to watch Peek Under the Hood of the New Apex Compiler, a Dreamforce 16 presentation that was later uploaded, that explains basically how the system works today, as well as plans for the near future. To summarize the video though, code is compiled mostly "on ...


10

Yes, its possible to install a custom application from an alternate source than app exchange. Following are different options: Packages: Developers can distribute links of their managed or unmanaged packages (custom apps), without publishing them to appexchange. Using this links admins can install the application in any Developer/Sandbox/Production orgs. ...


10

To list on the app exchange you need to be a partner. If the app is a paid managed app you will have to pay the security review fee. Unmanaged apps cannot be listed IIRC Additionally you will have a Revenue share (something like 25% now I think) with SF. The cost would be the $2,700. The impact on revenue would be 25% of collected revenue from the app. So ...


10

It probably depends on how you collect payment for those additional features. For paid apps there is also a revenue sharing component (currently 15%). However, I did find this: Does the revenue share apply to non-Checkout processed transactions? The revenue share applies only to Checkout transactions, that is, any charges in your Recurly account ...


9

FLS You must make sure that you honor FLS. That does not mean that every trigger, every utility function, etc must check every single field before attempting to access or update the value. It simply means that the front-end UI (any Visualforce) must use apex:inputText or apex:outputText to honor visual field level security, or that any other types of input, ...


9

Connected Apps require your subscriber (your customer) to go through a oAuth authentication flow (with a user of their choice) to allow your application to connect to their org. You cannot and should not attempt to cicrumvent this process for a variety of reasons, most of which security based as you hint at in your question. This however does not mean you ...


9

A really good breakdown of the difference between OEM and ISV has been posted on Linkedin here and copied below Key differences: (1) the app creator's contracts with Salesforce and end users (2) what end users receive. When you sell an app under an OEM agreement, you are selling the end user BOTH Salesforce Platform user licenses AND package ...


9

Update Salesforce does not allow unmanaged packages to be part of appexchange .You will have to convert them to managed packages . You can publish your apps as managed package to the appexchange provided you sign up as partner.Do not confuse that partner has to be some consulting firm .Anyone can be a partner Even as a solo developer you can be a part of ...


9

A free app is one in which salesforce security review won't cost you any money and your app can be installed by consumer free of cost. In a paid app you can control the license and the consumer will have to go through a payment portal to make payment and purchase license. Salesforce provides you with a LMA application to manage licenses. LMA is a Salesforce ...


8

You can't actually create a user and specify a password for it so you're going to run into a dead end right there. It sounds like the real time API will be running on the clients' orgs and you'll be connecting to those to consume data. If that's the case then things are definitely going to get complicated. You can not create a new user in the client org, ...


8

Step 1 When in the AppExchange publishing console you should be able to see a list of your recently uploaded pacakges, which will include the version you last uploaded. Along side the listing should be a link to start security review—you need to click that and go through the screens answering the questions that come up. This is a self-assessment process ...


8

I have some notes on using the BURP scanner to test a web service for submission to the security review - Using the Burp Suite to test a Web Service that is consumed in a Salesforce app. The basic idea is: Have BURP intercept typical requests by acting as a proxy as you browse around the site. If it is Salesforce calling a web service you will need to ...


8

Great question. First, watch this video: Ready to Partner with Salesforce.com (ISVforce or OEM)? (http://www.youtube.com/watch?v=_oV9LthQ5O0) ISV companies can sell licenses to their own apps (which I would say is the most common - this would be using the AppExchange to sell, say, 5 licenses of a managed package app. With new AppExchange checkout features ...


8

A custom app in Salesforce is not the same thing as an AppExchange app. A custom app is: An “app” is a group of tabs that works as a unit to provide application functionality. Salesforce provides standard apps such as Sales and Call Center. You can customize the standard apps to match the way you work. So, essentially, a custom app is just a ...


8

If the primary pain point is the duplication of code (not the duplication of objects or fields) then an approach is to create a separate project in your version control system for the common code. You can then add that code to both packages using mechanisms such as svn:externals via your IDE. So each managed package gets an identical copy of the code. This ...


8

You can join the partner program as an individual ISV partner and list free apps on the app exchange (managed or unmanaged) at no cost (I've done so!). However, you'll need to be fairly persistent with folks at SFDC to keep your stuff moving, they seem to forget about the small players sometimes.


8

To create a managed package,first you will need to create a namespace for your org . Note that once you choose a namespace you cannot change it . Once you have namespaced an org you can create a managed package application from the package manager .Note that if you do not namespace an org ,you will never get an option to make a package managed .


8

November 2020 Answer Converting from 1GP to 2GP is in Developer Preview in the Winter '21 (Oct 2020) release. You can join the Partner Community group which has all of the instructions for getting your Packaging Org enabled to pilot the functionality: https://partners.salesforce.com/_ui/core/chatter/groups/GroupProfilePage?g=0F94V000000PkSm Previous Answer (...


7

Chances are the Visualforce page in question hasn't been added to the allowed list for the site's guest user profile. The profile for guests isn't listed with the other user profiles, but found by clicking the "Public Access Settings" button when viewing the detail page for your site: When you're viewing the profile scroll all the way down to "Enabled ...


7

It is a one hour conference call in which you will give a brief demo of your app and/or design to one of salesforce experienced Technical Architects. You will need to be prepared to answer technical questions concerning the architecture of your proposed app. The below are questions you should be prepared with Describe the application purpose and your ...


7

During the security review process ,following things are checked 1.Apex code Security best practices .Force.com scanner is good tool to point out any risks 2.All your end points will be BURP Scanned .If your application makes a call to external SAP url ,even SAP URL will be BURP Scanned to discover any potential threats .Note for partners BURP Scanner is ...


Only top voted, non community-wiki answers of a minimum length are eligible