mirror of
https://github.com/forcedotcom/afv-library.git
synced 2026-08-02 21:34:30 +08:00
63 lines
2.2 KiB
XML
63 lines
2.2 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!--
|
|
Named Credential Template: Certificate-Based Authentication (Mutual TLS)
|
|
|
|
Use Case: High-security integrations requiring client certificate
|
|
- Financial services APIs
|
|
- Government integrations
|
|
- Healthcare systems (HIPAA compliance)
|
|
- Any API requiring mutual TLS (mTLS)
|
|
|
|
Prerequisites:
|
|
1. Obtain client certificate from external system or CA
|
|
2. Import certificate to Setup → Certificate and Key Management
|
|
3. Ensure external system trusts Salesforce's certificate
|
|
|
|
Setup Steps:
|
|
1. Replace all {{placeholder}} values
|
|
2. Upload certificate to Salesforce
|
|
3. Deploy to org
|
|
4. Test connection
|
|
|
|
File Location: force-app/main/default/namedCredentials/{{CredentialName}}.namedCredential-meta.xml
|
|
-->
|
|
<NamedCredential xmlns="http://soap.sforce.com/2006/04/metadata">
|
|
<fullName>{{CredentialName}}</fullName>
|
|
<label>{{CredentialLabel}}</label>
|
|
|
|
<!-- Base URL for the external service (must be HTTPS) -->
|
|
<endpoint>{{BaseEndpoint}}</endpoint>
|
|
|
|
<!-- Authentication Configuration -->
|
|
<principalType>Anonymous</principalType>
|
|
<protocol>NoAuthentication</protocol>
|
|
|
|
<!--
|
|
Client Certificate for Mutual TLS
|
|
Certificate must be imported in Setup → Certificate and Key Management
|
|
The certificate's private key is used to authenticate the client
|
|
-->
|
|
<certificate>{{CertificateName}}</certificate>
|
|
|
|
<!-- Request Options -->
|
|
<generateAuthorizationHeader>false</generateAuthorizationHeader>
|
|
<allowMergeFieldsInBody>true</allowMergeFieldsInBody>
|
|
<allowMergeFieldsInHeader>true</allowMergeFieldsInHeader>
|
|
|
|
<!--
|
|
Mutual TLS Flow:
|
|
1. Salesforce initiates HTTPS connection
|
|
2. External server presents its certificate
|
|
3. Salesforce validates server certificate
|
|
4. Salesforce presents client certificate
|
|
5. External server validates Salesforce's certificate
|
|
6. Encrypted channel established
|
|
7. API requests proceed
|
|
|
|
IMPORTANT:
|
|
- Certificate must have valid chain to trusted CA
|
|
- Certificate must not be expired
|
|
- External system must have Salesforce's public cert in truststore
|
|
-->
|
|
</NamedCredential>
|