Prerequisites

Alation Cloud Service Applies to Alation Cloud Service instances of Alation

Customer Managed Applies to customer-managed instances of Alation

Core Connector Core connectors are included with all Alation platform tiers (subject to each tier’s connector limits) and are fully supported by Alation.

Configure Network Connectivity

Open outbound TCP port 443 to the Salesforce server.

Create Service Account

For basic authentication and for the initial configuration of the OAuth-based connection, Alation requires a service account with a username and password. You can use an existing user or create a new user for Alation.

To use a new user, log in to Salesforce and create a User ID and Password. Refer to Usernames and Passwords for more information.

The service account user must have enough permissions to extract metadata from the database. See API Permissions below.

API Permissions

Before performing metadata extraction or sampling and profiling, ensure that you enable API permissions for the service account in Salesforce. In Salesforce, go to Setup > Profiles > <your user profile> > Administrative Permissions and select the API Enabled checkbox.

Configure OAuth

Important

Salesforce announced changes regarding restrictions on uninstalled connected apps. Salesforce OCF Connector is not affected by this change. This connector uses a customer-managed connected app that remains installed in your Salesforce organization, ensuring that authentication tokens continue to function without interruption. For more details, see Salesforce Help.

Set Up the OAuth App in Salesforce

Note

Some Salesforce organizations, including Developer Edition organizations, no longer support creating classic Connected Apps from App Manager. If your organization only allows you to create External Client Apps, use the steps in Set Up the OAuth App Using External Client Apps in Salesforce instead.

Before using the OAuth authentication, you must create an OAuth app in Salesforce.

  1. Log in to your Salesforce account and go to Apps > App Manager.

  2. Click New Connected App.

  3. In the Basic Information section, provide the required details including Connected App Name, API Name, and Contact Email and click Save.

  4. Once your app is created, open it in the Edit mode and perform the following and click Save:

    1. Select Enable OAuth Settings.

    2. Provide a callback URL in the Callback URL field. For example: https://localhost.

    3. Select Manage user data via APIs (api) in the Selected OAuth Scopes field. We recommend this scope over Full Access (full) for the Client Credentials flow, following the principle of least privilege.

    4. Select Enable Client Credentials Flow.

  5. Open your app in the Manage mode and click Edit Policies.

    1. Perform the following information in the OAuth Policies section:

      • Select All users may self-authorize from the Permitted Users dropdown.

      • Select Relax IP restriction from the IP Relaxation dropdown.

    2. In the Client Credentials Flow section, search and add the user to whom the API token will be issued in the Run As field.

    3. Click Save.

  6. Open the app in the View mode, and go to API (Enable OAuth Settings) > Consumer Key and Secret and click Manage Consumer Details.

  7. Copy the Consumer Key and Consumer Secret. Use these values to configure OAuth in Alation.

    Note

    Before configuring OAuth in Alation, we recommend validating that the Client ID works with the token endpoint.

Set Up the OAuth App Using External Client Apps in Salesforce

Before using the OAuth authentication, you must create an External Client App in Salesforce.

  1. Log in to your Salesforce account and go to Setup > App Manager.

  2. Click New External Client App.

  3. In the Basic Information section, provide the required details, including External Client App Name, API Name, and Contact Email, and then click Create.

  4. Once your app is created, open it in the Edit mode and perform the following and click Save:

    1. Select Enable OAuth Settings.

    2. Select Enable Client Credentials Flow.

    3. Select Manage user data via APIs (api) in the Selected OAuth Scopes field. We recommend this scope over Full Access (full) for the Client Credentials flow, following the principle of least privilege.

  5. Go to Setup > External Client App Manager, open your app, go to the Policies tab, and click Edit.

    1. In the OAuth Policies section, select Enable Client Credentials Flow.

    2. Select Relax IP restrictions from the IP Relaxation dropdown while testing, if allowed by your organization policy.

    3. In the Client Credentials Flow section, search and add the user to whom the API token will be issued in the Run As field. Make sure that this user has API access enabled. See API Permissions.

    4. Click Save.

  6. Go to Setup > External Client App Manager, open your app, and go to Settings > OAuth Settings > Consumer Key and Secret.

  7. Copy the Consumer Key and Consumer Secret. Use these values to configure OAuth in Alation.

    Note

    Before configuring OAuth in Alation, validate that Salesforce returns an access token from the token endpoint (https://<your-salesforce-domain>/services/oauth2/token) using grant_type=client_credentials with your Consumer Key as the client_id and your Consumer Secret as the client_secret. If this request doesn’t return an access token, resolve the issue in Salesforce before you configure OAuth in Alation.

Configure OAuth Using Client Credentials Workflow in Alation

To use OAuth authentication, you must configure OAuth using Client Credentials Workflow:

  1. Start the Connector Access Gateway Service. For information, see the Alation: Start the Connector Access Gateway Service section in Authenticate via AWS STS and an IAM Role.

  2. In Alation, click the Settings gear icon in the top right corner.

  3. Click Authentication.

  4. Under the Authentication Configuration Methods for External Systems section, select OAuth from the Add configuration dropdown.

  5. Configure an OAuth profile with the following details. For more information, see the OAuth section in the Authentication Configuration Methods for External Systems.

    Field

    Description

    Config Name

    Specify a name for the OAuth configuration.

    Client Id

    Specify the Consumer Key you copied from Salesforce.

    Client Secret

    Specify the Consumer Secret you copied from Salesforce.

    Grant Type

    Under Client credentials, select Client Credentials.

    Token Endpoint URL

    Specify the Salesforce token endpoint in the following format: https://<your-salesforce-domain>/services/oauth2/token

    For more information on this flow, see OAuth 2.0 Client Credentials Flow for Server-to-Server Integration.

    Note

    Leave the Authorize Endpoint URL, User Info Endpoint URL, and the Redirect URL fields blank.

  6. Click Save.

  7. Go to the General Settings tab of your Salesforce OCF data source and configure authentication:

    1. In the Connector Settings section, go to the Authentication section.

    2. Select OAuth Client Credential from the Auth Type dropdown.

    3. Select the OAuth profile you created in step 5 from the Authentication Profiles dropdown.

    4. Click Save.

    For more information, see the Configure OAuth Authentication section in Configure the Data Source Connection.

    Important

    Do not set Initiate OAuth to GETANDREFRESH or REFRESH, and do not provide a value for OAuthRefreshToken. Those settings belong to a separate, refresh-token-based OAuth flow. Using them together with the OAuth Client Credentials flow causes connection errors, including OAuthRefreshToken is required.

  8. Go to General Settings > Test Connection and click Test to confirm that the connection succeeds.