mirror of
https://github.com/forcedotcom/afv-library.git
synced 2026-07-30 19:50:42 +08:00
169 lines
20 KiB
JSON
169 lines
20 KiB
JSON
{
|
||
"sections": [
|
||
"title",
|
||
"description",
|
||
"file_information",
|
||
"directory_location",
|
||
"fields",
|
||
"wsdl_segment",
|
||
"declarative_metadata_sample_definition"
|
||
],
|
||
"title": "AuthProvider - Metadata API",
|
||
"description": "Represents an authentication provider (auth provider). An auth provider lets users log in to Salesforce from an external service provider such as Facebook, Google, or GitHub. This type extends the Metadata metadata type and inherits its fullName field.",
|
||
"file_information": ".authprovider",
|
||
"directory_location": "authproviders",
|
||
"fields_columns": [
|
||
"type",
|
||
"description"
|
||
],
|
||
"fields": {
|
||
"appleTeam": {
|
||
"type": "string",
|
||
"description": "Required when using Apple as a third-party authentication provider. A 10-character team ID, obtained from an Apple developer account. Available in API version 48.0 and later.",
|
||
"required": true
|
||
},
|
||
"authorizeUrl": {
|
||
"type": "string",
|
||
"description": "Required when creating an OpenID Connect authentication provider. The OAuth authorization endpoint URL. Available in API version 29.0 and later. In API version 33.0 and later, for Salesforce-managed auth providers, leave the field blank to let Salesforce supply and manage the value. For details, see “Usage.”",
|
||
"required": true
|
||
},
|
||
"consumerKey": {
|
||
"type": "string",
|
||
"description": "The app’s key that is registered at the third-party (external) authentication provider. In API version 33.0 and later, for Salesforce-managed auth providers, leave the field blank to let Salesforce supply and manage the value. For details, see “Usage.”"
|
||
},
|
||
"consumerSecret": {
|
||
"type": "string",
|
||
"description": "The consumer secret of the app that is registered at the third-party provider. After it’s set, you can’t change the value. When using create(), this field must be encrypted. To create an encrypted form of the consumer secret from plaintext: Create an authentication provider with the consumerSecret plaintext value. Save the authentication provider. Create an outbound change set that includes the authentication provider component. The new change set.xml file has an entry in the form <consumerSecret>++XYZ++</consumerSecret> where ++XYZ++ is the encrypted secret. In API version 33.0 and later, for Salesforce-managed auth providers, leave the field blank to let Salesforce supply and manage the value. For details, see Usage. If a consumer secret is defined on an authentication provider, the consumer secret is always exported as a placeholder value, not as an encrypted secret."
|
||
},
|
||
"controlPlane": {
|
||
"type": "MuleSoftControlPlane (enumeration of type string)",
|
||
"description": "Required when using MuleSoft as a third-party authentication provider. Environment where the MuleSoft Anypoint Platform control plane is hosted. The control plane is the part of the Anypoint Platform architecture that includes Anypoint Exchange and determines the login URL. If you select User-Specified, you must enter the Consumer Key and Consumer Secret. Obtain the values from the MuleSoft connected app that you created to store the authentication details for your Salesforce org. Available in API version 57.0 and later. Valid values include: None—User-specified control plane. If you select None, you must enter the Consumer Key and Consumer Secret. Obtain the values from the MuleSoft connected app that you created to store the authentication details for your Salesforce org. US—US control plane EU—EU control plane",
|
||
"required": true
|
||
},
|
||
"customMetadataTypeRecord": {
|
||
"type": "string",
|
||
"description": "Required when creating a custom authentication provider plug-in. The API name of the custom authentication provider. Available in API version 36.0 and later.",
|
||
"required": true
|
||
},
|
||
"defaultScopes": {
|
||
"type": "string",
|
||
"description": "For OpenID Connect authentication providers, the scopes to send with the authorization request, if not specified when a flow starts. Available in API version 29.0 and later. In API version 33.0 and later, for Salesforce-managed auth providers, leave the field blank to let Salesforce supply and manage the value. See “Usage.”"
|
||
},
|
||
"ecKey": {
|
||
"type": "string",
|
||
"description": "Required when using Apple as a third-party authentication provider. A private key generated by Apple. Available in API version 48.0 and later.",
|
||
"required": true
|
||
},
|
||
"errorUrl": {
|
||
"type": "string",
|
||
"description": "A custom error URL for the authentication provider to use to report errors."
|
||
},
|
||
"executionUser": {
|
||
"type": "string",
|
||
"description": "Required to specify a registration handler. The username of the Salesforce admin or system user who runs the Apex handler or flow. The execution user provides the context in which the registration handler runs. For example, if the handler creates a contact, the creation can be easily traced back to the registration process. In production, use a system user. The user must have the Manage Users permission. Available in API version 27.0 and later.",
|
||
"required": true
|
||
},
|
||
"flow": {
|
||
"type": "string",
|
||
"description": "A flow for the registration handler. The flow must be of the Identity User Registration Flow type. You can use either a flow or an Apex class for the registration handler. To use an Apex class instead, omit the flow field and specify an Apex class in the registrationHandler field. Available in API version 64.0 and later."
|
||
},
|
||
"flowDefaultAccount": {
|
||
"type": "string",
|
||
"description": "For authentication providers that use a flow registration handler, the default account that new external users are assigned to. If you include this field, Salesforce automatically uses it for the defaultAccountId variable in the Authentication Provider User Registration standard flow. A default account is required to use a flow registration handler to create and update external users. You can specify a default account here or in the flow itself. If you use both, the default account that's configured in the flow takes precedent. Available in API version 64.0 and later."
|
||
},
|
||
"flowDefaultProfile": {
|
||
"type": "string",
|
||
"description": "For authentication providers that use a flow registration handler, the default profile that new users are assigned to. If you include this field, Salesforce automatically uses it for the defaultProfileId variable in the Authentication Provider User Registration standard flow. A default profile is required to use a flow registration handler. You can specify a default profile here or in the flow itself. If you use both, the default profile that's configured in the flow takes precedent. Available in API version 64.0 and later."
|
||
},
|
||
"friendlyName": {
|
||
"type": "string",
|
||
"description": "A user-friendly name for the authentication provider.",
|
||
"required": true
|
||
},
|
||
"iconUrl": {
|
||
"type": "string",
|
||
"description": "The path to an icon to use as a button on the login page. Users click the button to log in with the associated authentication provider, such as Twitter or Facebook. Available in API version 32.0 and later."
|
||
},
|
||
"idTokenIssuer": {
|
||
"type": "string",
|
||
"description": "The source of the authentication token in https: URI format. This field is available when configuring an OpenID Connect or Microsoft authentication provider. If provided, Salesforce validates the returned id_token value. OpenID Connect requires returning an id_token value with the access_token value. Available in API version 30.0 and later."
|
||
},
|
||
"includeOrgIdInIdentifier": {
|
||
"type": "boolean",
|
||
"description": "Used to differentiate between users with the same user ID from two sources (such as two sandboxes). If enabled (true), Salesforce stores the org ID of the third-party identity in addition to the user ID. After you enable this setting, you can’t disable it. Applies only to a Salesforce-managed auth provider. Available in API version 32.0 and later."
|
||
},
|
||
"isPkceEnabled": {
|
||
"type": "boolean",
|
||
"description": "Indicates whether the OAuth 2.0 Proof Key for Code Exchange (PKCE) security extension is enabled (true) or not (false). You can enable PKCE for these providerType values. Custom Facebook Google Microsoft OpenIdConnect Salesforce. This field is available in API version 59.0 and later."
|
||
},
|
||
"linkKickoffUrl": {
|
||
"type": "string",
|
||
"description": "The URL for linking existing Salesforce users to a third-party account. This field is read-only. Available in API version 43.0 and later."
|
||
},
|
||
"logoutUrl": {
|
||
"type": "string",
|
||
"description": "The destination for users after they log out if they authenticated using single sign-on. The URL must be fully qualified with an http or https prefix, such as https://acme.my.salesforce.com. Available in API version 33.0 and later."
|
||
},
|
||
"oauthKickoffUrl": {
|
||
"type": "string",
|
||
"description": "The URL for obtaining OAuth access tokens for a third party. This field is read-only. Available in API version 43.0 and later."
|
||
},
|
||
"paramForwardAllowlist": {
|
||
"type": "AuthProvParamFwdAllowlist[]",
|
||
"description": "An allowlisted URL parameter that can be forwarded from the authentication provider's client configuration URLs to the authorization URL. Available in API version 62.0 and later."
|
||
},
|
||
"plugin": {
|
||
"type": "string",
|
||
"description": "An existing Apex class that extends the Auth.AuthProviderPluginClass abstract class. Available in API version 36.0 and later."
|
||
},
|
||
"portal": {
|
||
"type": "string",
|
||
"description": "This field is used only with portals, which are deprecated. Salesforce doesn’t support creating portals, but existing portals are supported."
|
||
},
|
||
"providerType": {
|
||
"type": "AuthProviderType (enumeration of type string)",
|
||
"description": "The third-party authentication provider to use. Valid values include: Apple Bitbucket—Provides authentication for a Bitbucket provider. Enables you to connect to Bitbucket from a Lightning Platform application. When logged in to Bitbucket, the app can makes calls to Bitbucket APIs. The Bitbucket provider isn’t available as an SSO provider, so users can’t log in to a Salesforce org using their Bitbucket login credentials. Available in API version 61.0 and higher. Custom—A provider configured with a custom authentication provider plug-in. Available in API version 36.0 and later. Facebook. GitHub—Provides authentication for a GitHub provider. Used to log in users of your Lightning Platform app to GitHub using OAuth. When logged in to GitHub, your app can make calls to GitHub APIs. The GitHub provider isn’t available as an SSO provider, so users can’t log in to your Salesforce org using their GitHub login credentials. Available in API version 35.0 and later. Google. Janrain. LinkedIn. Available in API version 32.0 and later. Microsoft—Provides authentication for all services that can be accessed via Microsoft Azure Active Directory. Available in API version 55.0 and later. MicrosoftACS—Microsoft Access Control Service typically provides authentication for a Microsoft Office 365 service, like SharePoint Online. The MicrosoftACS provider doesn't support SSO. Available in API version 31.0 and later. MuleSoft. Available in API version 57.0 and later. OpenIdConnect. Available in API version 29.0 and later. Salesforce. Slack. Available in API version 54.0 and later. Twitter. Available in API version 32.0 and later.",
|
||
"required": true
|
||
},
|
||
"registrationHandler": {
|
||
"type": "string",
|
||
"description": "An existing Apex class that implements the Auth.RegistrationHandler interface. You can use either an Apex class or a flow for the registration handler. To use a flow instead, omit the registrationHandler field and specify a flow in the flow field."
|
||
},
|
||
"requireMfa": {
|
||
"type": "boolean",
|
||
"description": "Requires multi-factor authentication (MFA) for single sign-on with this auth provider based on the MFA status of each user. For this setting to trigger MFA, you must apply MFA directly to users via one of two methods. 1) Enable the org setting Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org. 2) Assign the user permission multi-factor authentication for User Interface Logins."
|
||
},
|
||
"sendAccessTokenInHeader": {
|
||
"type": "boolean",
|
||
"description": "If enabled (true), the access token is sent to the UserInfoUrl in a header instead of a query string. Available in API version 30.0 and later."
|
||
},
|
||
"sendClientCredentialsInHeader": {
|
||
"type": "boolean",
|
||
"description": "Required when creating an OpenID Connect authentication provider. If enabled (true), the client credentials are sent in a header to the tokenUrl instead of a query string. The credentials are in the standard OpenID Connect Basic Credentials header format, which is Basic <token>, where <token> is the base64-encoded string \"clientkey:clientsecret\". Available in API version 30.0 and later.",
|
||
"required": true
|
||
},
|
||
"sendSecretInApis": {
|
||
"type": "boolean",
|
||
"description": "Determines whether the encrypted consumer secret appears in API responses. If enabled (default), the secret appears in the response. If disabled (false), responses don’t include the consumer secret. For security, you can disable the setting. However, keep in mind that: By disabling this setting, the consumer secret is excluded from API responses in all API versions. Change sets and other metadata deployments break because both the consumer key and secret are expected. To fix this problem, insert the consumer key manually during deployment. Available in API version 47.0 and later. The consumer secret is always included in the response as a placeholder value, regardless of the value provided for sendSecretInApis."
|
||
},
|
||
"ssoKickoffUrl": {
|
||
"type": "string",
|
||
"description": "The URL for performing single sign-on into Salesforce from a third party by using its third-party credentials. This field is read-only. Available in API version 43 and later."
|
||
},
|
||
"tokenUrl": {
|
||
"type": "string",
|
||
"description": "The OAuth token endpoint URL of an OpenID Connect authentication provider. Available in API version 29.0 and later. In API version 33.0 and later, for Salesforce-managed auth providers, leave the field blank to let Salesforce supply and manage the value. For details, see “Usage.”"
|
||
},
|
||
"userInfoUrl": {
|
||
"type": "string",
|
||
"description": "The OpenID Connect endpoint URL of the OpenID Connect authentication provider. Available in API version 29.0 and later. In API version 33.0 and later, for Salesforce-managed auth providers, leave the field blank to let Salesforce supply and manage the value. For details, see “Usage.”"
|
||
}
|
||
},
|
||
"wsdl_segment": "```xml\n<xsd:complexType name=\"AuthProvParamFwdAllowlist\">\n <xsd:sequence>\n <xsd:element name=\"description\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"param\" type=\"xsd:string\"/>\n </xsd:sequence>\n</xsd:complexType>\n<xsd:complexType name=\"AuthProvider\">\n <xsd:complexContent>\n <xsd:extension base=\"tns:Metadata\">\n <xsd:sequence>\n <xsd:element name=\"appleTeam\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"authorizeUrl\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"consumerKey\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"consumerSecret\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"controlPlane\" minOccurs=\"0\" type=\"tns:MuleSoftControlPlane\" nillable=\"true\"/>\n <xsd:element name=\"customMetadataTypeRecord\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"defaultScopes\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"ecKey\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"errorUrl\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"executionUser\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"flow\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"flowDefaultAccount\" minOccurs=\"0\" type=\"xsd:string\" nillable=\"true\"/>\n <xsd:element name=\"flowDefaultProfile\" minOccurs=\"0\" type=\"xsd:string\" nillable=\"true\"/>\n <xsd:element name=\"friendlyName\" type=\"xsd:string\"/>\n <xsd:element name=\"iconUrl\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"idTokenIssuer\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"includeOrgIdInIdentifier\" minOccurs=\"0\" type=\"xsd:boolean\"/>\n <xsd:element name=\"isPkceEnabled\" minOccurs=\"0\" type=\"xsd:boolean\"/>\n <xsd:element name=\"linkKickoffUrl\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"logoutUrl\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"oauthKickoffUrl\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"paramForwardAllowlist\" minOccurs=\"0\" maxOccurs=\"unbounded\" type=\"tns:AuthProvParamFwdAllowlist\" nillable=\"true\"/>\n <xsd:element name=\"plugin\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"portal\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"providerType\" type=\"tns:AuthProviderType\"/>\n <xsd:element name=\"registrationHandler\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"requireMfa\" minOccurs=\"0\" type=\"xsd:boolean\"/>\n <xsd:element name=\"sendAccessTokenInHeader\" minOccurs=\"0\" type=\"xsd:boolean\"/>\n <xsd:element name=\"sendClientCredentialsInHeader\" minOccurs=\"0\" type=\"xsd:boolean\"/>\n <xsd:element name=\"sendSecretInApis\" minOccurs=\"0\" type=\"xsd:boolean\"/>\n <xsd:element name=\"ssoKickoffUrl\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"tokenUrl\" minOccurs=\"0\" type=\"xsd:string\"/>\n <xsd:element name=\"userInfoUrl\" minOccurs=\"0\" type=\"xsd:string\"/>\n </xsd:sequence>\n </xsd:extension>\n </xsd:complexContent>\n</xsd:complexType>\n<xsd:simpleType name=\"AuthProviderType\">\n <xsd:restriction base=\"xsd:string\">\n <xsd:enumeration value=\"Facebook\"/>\n <xsd:enumeration value=\"Janrain\"/>\n <xsd:enumeration value=\"Salesforce\"/>\n <xsd:enumeration value=\"OpenIdConnect\"/>\n <xsd:enumeration value=\"MicrosoftACS\"/>\n <xsd:enumeration value=\"LinkedIn\"/>\n <xsd:enumeration value=\"Twitter\"/>\n <xsd:enumeration value=\"Google\"/>\n <xsd:enumeration value=\"GitHub\"/>\n <xsd:enumeration value=\"Custom\"/>\n <xsd:enumeration value=\"Apple\"/>\n <xsd:enumeration value=\"Evergreen\"/>\n <xsd:enumeration value=\"Slack\"/>\n <xsd:enumeration value=\"HubSpot\"/>\n <xsd:enumeration value=\"Microsoft\"/>\n <xsd:enumeration value=\"MuleSoft\"/>\n <xsd:enumeration value=\"Bitbucket\"/>\n <xsd:enumeration value=\"MuleSoftAnypointPlatform\"/>\n <xsd:enumeration value=\"Confluence3LO\"/>\n <xsd:enumeration value=\"CommerceCloudAccountManager\"/>\n </xsd:restriction>\n</xsd:simpleType>\n<xsd:complexType name=\"Metadata\">\n <xsd:sequence>\n <xsd:element name=\"fullName\" minOccurs=\"0\" type=\"xsd:string\"/>\n </xsd:sequence>\n</xsd:complexType>\n<xsd:simpleType name=\"MuleSoftControlPlane\">\n <xsd:restriction base=\"xsd:string\">\n <xsd:enumeration value=\"None\"/>\n <xsd:enumeration value=\"US\"/>\n <xsd:enumeration value=\"EU\"/>\n </xsd:restriction>\n</xsd:simpleType>\n```",
|
||
"declarative_metadata_sample_definition": [
|
||
{
|
||
"description": "Note: Starting in November 2022, enter the consumerSecret value as plaintext, for example, <consumerSecret>yourplaintextconsumersecret</consumerSecret>. Existing consumer secrets that were entered as encrypted values can be deployed throughout the Winter ‘23 release. <?xml version=\"1.0\" encoding=\"UTF-8\"?> <Package xmlns=\"http://soap.sforce.com/2006/04/metadata\"> <types> <members>FacebookAuthProvider</members> <name>AuthProvider</name> </types> <version>28.0</version> </Package>",
|
||
"code": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<AuthProvider xmlns=\"http://soap.sforce.com/2006/04/metadata\">\n <consumerKey>yourappkey</consumerKey>\n <consumerSecret>PwdVxXjzu3NCZ3MD4He+wA==</consumerSecret>\n <executionUser>admin@your.org</executionUser>\n <friendlyName>FacebookAuthProvider</friendlyName>\n <providerType>Facebook</providerType>\n <registrationHandler>RegistrationHandler</registrationHandler>\n <sendSecretInApis>true</sendSecretInApis> \n</AuthProvider>"
|
||
}
|
||
]
|
||
} |