Salesforce Connector

Overview

Used for OneTrust Data Discovery, the Salesforce connector works with connected apps to authorize and scan external systems that integrate with Salesforce via API and standard protocols.

Pod Residency

app-scanner

Connection Method

REST API

  • Authorization OAuth 2.0 Username-Password Flow

  • Authorization OAuth 2.0 Credentials-Client Flow

Supported Scan Actions

Scan Type

Description

Catalog

This will collect the metadata for Salesforce Services Object.

Catalog & Scan

This will collect metadata for services and its resource and go for data extraction after that. It will return personally identifiable information (PII), data elements (DE), and Terms as per the classification label identified.

Credentials and Permissions

OneTrust recommends to adhere to your organization's security and infrastructure policy and include system engineer resources or other qualified subject matter experts to set up credentials on data sources. For specific instructions for how to enable these credentials, refer to your data source's implementation documentation, knowledge base and/or support resources.

Note:

Note: SSO credentials are not supported in Salesforce.

Sample JSON: Username-Password Flow

The currently supported Salesforce API version is v51.0. Ensure to use v51.0 in the Vault JSON configuration. If you encounter any issues, please contact OneTrust Support for assistance.

JSON 
{
    "client_id": "your_client_id",
    "client_secret": "your_client_secret",
    "grant_type": "password",
    "password": "your_password",
    "salesforceAuthUrl": "https://<SFDC_FQN>.salesforce.com/services/oauth2/token",
    "username": "your_username",
    "version": "v51.0"
}

Required for Username-Password Flow

  • Connected app assigned to the profile. For more information, see Creating Salesforce Connected Apps.

  • Security token must be added to the password, in the following format:

    CODE 
    "password": "<password><token>", 

"password": "samplepasswordXmcVRC",

  • API enabled

  • View Object permission for any type of object you're trying to query

  • Provide the following for your vault credentials Salesforce Auth URL:

    Production:

    CODE 
    "salesforceAuthUrl": "https://login.salesforce.com/services/oauth2/token"

    Test:

    CODE 
    "salesforceAuthUrl": "https://test.salesforce.com/services/oauth2/token"
    Note:

    This is the default URL option. Customers can exchange for custom Auth URL.

Note:

For additional information on user permissions for connected apps, please see Salesforce's developer documenation.

Sample JSON: Credentials-Client Flow

Salesforce is deprecating the OAuth Password Grant method due to security policies. This guide provides an alternative authentication solution using External Client Apps and the Client Credentials Flow.

Important:

Starting in the OneTrust Spring ‘26 release, new Connected Apps can no longer be created. Existing customers using Connected Apps are not affected. For new integrations, use External Client Apps as described below.

CODE 
Important: Starting Spring ‘26, new Connected Apps can no longer be created. Existing customers using Connected Apps are not affected. For new integrations, use External Client Apps as described below.

Required for Credentials-Client Flow

  • External Client app assigned to the profile. For more information, see Creating Salesforce External Client Apps.

    Note:

    For additional information on user permissions for External client apps, please see Salesforce's developer documenation.

  • API enabled

  • View Object permission for any type of object that is being queried

  • Provide the following for your vault credentials Salesforce Auth URL:

    Production

    "salesforceAuthUrl": "https://login.salesforce.com/services/oauth2/token"

    Test

    "salesforceAuthUrl": "https://test.salesforce.com/services/oauth2/token"

    Note:

    This is the default URL option. Customers can exchange for custom Auth URL.

Scan Profile Support

For additional details on scan profile configuration and management, see Setting Up Scan Profiles.

Object Type

Note:

Object type scanning for web apps is currently under Public Preview.

  • Objects

  • Attachments

Limits

  • Limits the number of Objects to scan. Requires provision of Salesforce Object.

    • If objects is chosen: Maximum number of Objects

    • If attachments is chosen: Maximum number of Attachments

Include/Exclude Paths Support for Objects

  • Include/Exclude support of Salesforce Object API Names. Does not include Object Label or Object Name.

Wildcard

  • Wildcard is supported in the include/exclude paths. If [*] is specified under the Salesforce Object, then it will scan all the objects.

Salesforce Marketing Cloud Support

The Generic JDBC connector is used to scan Salesforce Marketing Cloud. Please contact OneTrust.