mirror of
https://github.com/forcedotcom/afv-library.git
synced 2026-08-02 05:09:27 +08:00
88 lines
3.0 KiB
XML
88 lines
3.0 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!--
|
|
External Credential Template: OAuth 2.0 (API 61+)
|
|
|
|
Use Case: Modern OAuth 2.0 with Named Principal or Per-User authentication
|
|
- New integrations (recommended over legacy Named Credentials)
|
|
- APIs requiring per-user context
|
|
- Fine-grained permission control via Permission Sets
|
|
|
|
API Version: 61.0+ (Spring '24+) REQUIRED
|
|
|
|
Key Concepts:
|
|
- External Credential: Defines auth protocol and parameters
|
|
- Named Principal: Shared service account identity
|
|
- Per-User Principal: Individual user authentication
|
|
- Permission Set: Controls access to principals
|
|
|
|
Setup Steps:
|
|
1. Replace all {{placeholder}} values
|
|
2. Deploy to org
|
|
3. Create Named Credential referencing this External Credential
|
|
4. Assign Permission Set to users
|
|
|
|
File Location: force-app/main/default/externalCredentials/{{CredentialName}}.externalCredential-meta.xml
|
|
-->
|
|
<ExternalCredential xmlns="http://soap.sforce.com/2006/04/metadata">
|
|
<label>{{CredentialLabel}}</label>
|
|
|
|
<!-- Authentication Protocol: Oauth, Custom, NoAuth, JWT, JwtExchange -->
|
|
<authenticationProtocol>Oauth</authenticationProtocol>
|
|
|
|
<!--
|
|
OAuth Parameters
|
|
These define how Salesforce obtains and refreshes tokens
|
|
-->
|
|
<externalCredentialParameters>
|
|
<parameterName>clientId</parameterName>
|
|
<parameterType>AuthProviderClientId</parameterType>
|
|
<parameterValue>{{ClientId}}</parameterValue>
|
|
</externalCredentialParameters>
|
|
|
|
<externalCredentialParameters>
|
|
<parameterName>clientSecret</parameterName>
|
|
<parameterType>AuthProviderClientSecret</parameterType>
|
|
<!-- Value entered via UI for security -->
|
|
</externalCredentialParameters>
|
|
|
|
<externalCredentialParameters>
|
|
<parameterName>scope</parameterName>
|
|
<parameterType>AuthProviderScope</parameterType>
|
|
<parameterValue>{{Scopes}}</parameterValue>
|
|
</externalCredentialParameters>
|
|
|
|
<externalCredentialParameters>
|
|
<parameterName>tokenEndpoint</parameterName>
|
|
<parameterType>AuthProviderTokenEndpoint</parameterType>
|
|
<parameterValue>{{TokenEndpoint}}</parameterValue>
|
|
</externalCredentialParameters>
|
|
|
|
<!--
|
|
Named Principal Configuration
|
|
Shared service account for all users with permission
|
|
-->
|
|
<principals>
|
|
<principalName>{{PrincipalName}}</principalName>
|
|
<principalType>NamedPrincipal</principalType>
|
|
<sequenceNumber>1</sequenceNumber>
|
|
</principals>
|
|
|
|
<!--
|
|
Optional: Per-User Principal
|
|
Each user authenticates individually
|
|
|
|
<principals>
|
|
<principalName>PerUserPrincipal</principalName>
|
|
<principalType>PerUserPrincipal</principalType>
|
|
<sequenceNumber>2</sequenceNumber>
|
|
</principals>
|
|
-->
|
|
|
|
<!--
|
|
Permission Set Integration:
|
|
After deployment, create Permission Set with:
|
|
- External Credential Principal Access: {{PrincipalName}}
|
|
- Assign to users who need API access
|
|
-->
|
|
</ExternalCredential>
|