Salesforce

Overview

The source connector fetches data from Event Monitoring and Standard Objects.

Streams

Prerequisites

Salesforce customers must enable Event Monitoring before onboarding logs to Tarsal. An additional license may be required for this Salesforce add-on.

Step 1: Create an API User in Salesforce

Tarsal requires a user account with API and Event Log File permissions in order to retrieve Event Monitoring logs.

We recommend creating a new, dedicated user with the minimum permissions required by Tarsal. Salesforce requires each user to have a unique username, but the same email address can be used for multiple users. Thus, you can create a Tarsal-only account without having to manage an additional email address in your organization.

In order to create and add permissions to the new user, the 'Manage Users' permission is required.

To create a user:

1. Follow the instructions in the Salesforce documentation to add a new user.
   1. For User License, select "Salesforce."
   2. For Profile, create a new profile cloned from "Minimum Access - Salesforce"
      1. For the newly created profile, select:
         1. Under Administrative Permissions:
         • "View Setup and Configuration"
         • "Subscribe to Dashboards"
         2. Under General User Permissions
            • "Export Reports"
            • "Manage Content Properties"
         3. Under Standard Object Permissions
            • "Accounts"
            • "Opportunities"
2. Complete the user registration process by accessing the link sent to the new user’s email to set up a password.

Step 2: Retrieve Security Token from Salesforce API

Salesforce API access requires username, password, client id, client secret and a credential called security token.

To request a security token for a new Salesforce user account:

• Log in with the newly created user
• Request a security token for a new Salesforce user account. Follow instructions in this Salesforce documentation to request a token.
• After receiving the token, log out of the newly created account and continue the following steps with the admin account.

Step 3: Create and assign a new Permission Set in Salesforce

To assign permissions to the new user, you must create a new Permission Set.

1. Follow the instructions in Salesforce's Create Permission Sets documentation to add a new permission set that grants Tarsal access to the Event Monitoring data via the SOAP/REST API.
2. On your new Permission Set's page, click System Permissions:
   1. Click Edit, then check the boxes to enable the following permissions:
      • API Enabled
      • View Event Log Files
3. Assign the Permission Set to the designated user by following the instructions in Salesforce's documentation to assign Permission Sets to a Single User.

Step 4: Create a Connected App

Search App Manager from sidebar quick search and select New Connected App. More information is available in the Salesforce docs but for Tarsal integration, we need following;

1. Fill out basic details of the app
2. Enable OAuth Settings checkbox, which will enable additional inputs, Fill out the following fields:
   1. Selected OAuth Scopes; From the available scopes, select Full access(full)
   2. Callback URL; Use https://login.salesforce.com/services/oauth2/success as the input.
3. Enable Client Credentials Flow checkbox

After completing the setup, view the app. A new button labeled “Manage Consumer Details” will appear under API (Enable OAuth Settings). Click this button to be redirected to the Consumer Details page, where you will find the Consumer Key and Consumer Secret. Once you have obtained these credentials, ensure you also complete the following steps:

• Navigate to Apps > Manage Connected Apps > (The name of your app) > Edit Application > OAuth Policies, and set “Permitted users” to “All users may self-authorize.”
• In the same location, set “IP Relaxation” to “Relax IP restrictions.”

Step 5: OAuth Username-Password Flows

• In the sidebar quick search, type “OAuth” and select “OAuth and OpenID Connect Settings.” Alternatively, navigate to Setup > Security Controls > OAuth and OpenID Connect Settings.
• Once on the settings page, check the “Enable OAuth Username-Password Flows” box.

Configuration

Connector Limitations

1. When first configured, the connector will load the last 24 hours of logs.
2. This connector is restricted by rate limits.