Creating Salesforce Connected Apps

You can create a Salesforce connected app and configure an instance with the OneTrust application credentials to assist with data discovery operations. For additional details on building integrations with connected apps, click here.

To create a new connected app

  1. In the main navigation menu, click the Gear icon to select Setup. The Setup Home screen appears.

  2. In the sidebar under Platform Tools, click Apps > App Manager. The Setup App Manager screen appears.

  3. Click the New Connected App button. The New Connected App block appears.

  4. Complete the fields and add the following information:

    • Enable OAuth

    • Add Callback URL in the following format: https://<OneTrust Environment FQDN>/integrationmanager/api/v1/tokens/callback. Example: app.onetrust.com for OneTrust Environment FQDN. The exact Callback URL can also be validated and copied from the Credentials screen in the OneTrust app. See the table in To create app credentials in OneTrust

  5. Move the below OAuth Scopes into the Selected OAuth Scopes column as your Application Permissions:

    • Full Access (full)

    • Manage user data via APIs (api)

    • Perform requests any time (refresh_token, offline_access)

  6. Copy the Consumer Key (Client ID) and click to reveal the Consumer Secret (Client Secret). This will need to be referenced and used in the following steps.

To enable the APIs for the user profile

  1. Navigate to Users > Profiles in the Salesforce Setup menu.
  2. Locate the desired user profile that will be used to create the credential.
  3. Turn on the API Enabled setting under Administrative Permissions.

To configure the connected app

  1. Navigate to Apps > Connected Apps > Manage Connected Apps, then select to edit your app.
  2. Set Permitted Users to: All users may self-authorize
  3. Set IP Relaxation to: Relax IP restrictions
  4. Click the Save button.


    Note:

    To prevent inheriting existing SFDC credentials, perform the following OAuth setup in a private browsing session.

To create app credentials in OneTrust

  1. In the OneTrust application, navigate to Data Discovery > Credentials.
  2. Click the Add New button. The Add Credential - Select System screen appears.

  3. Select Salesforce, then click the Next button. The Enter Credential Details screen appears.

  4. Create a new Salesforce credential with the following information.
    Field
    Description
    Credential Name

    Enter a name for the new credential.

    Credential Type

    Select Custom

    Connector Type

    Select HTTP

    Auth Type

    Select OAuth 2

    Protocol

    Select HTTPS

    Hostname

    In format of : <SFDC-FQDN>

    Test URL

    In format of: https://<SFDC-FQDN>

    Grant Type

    Select Password Credentials

    Access Token URL

    In format of: https://<SFDC-FQDN>/services/oauth2/token

    Username

    Enter your SFDC username.

    Password

    Enter your SFDC password.

    Client ID

    Paste Consumer Key from connected app.

    Client Secret

    Paste Consumer Secret from connected app.

    Send Authorization Parameters

    Select Request Params.

  5. Click the Generate Token button to display username and password fields.
  6. Copy the populated Access Token.
  7. Enable to grant permission.
  8. Click the Save button.

To add credentials to worker node vault

The user below can be a Salesforce Standard User. This user's credentials will be used to read data for OneTrust Data Discovery processing.

  1. Add the Salesforce Credentials in the following JSON format:
    JSON 
    {
"client_id": "<CLIENT-ID>",
"client_secret": "<CLIENT-SECRET>",
"grant_type": "password",
"password": "<SFDC-Password>",
"username": "<SFDC-Username>"
}
  2. For additional resources on setting up data sources and vault credentials, see the following:

    1. Connecting & Managing Data Sources

    2. Vault Configuration

Vault Configuration

  1. Port forward the installed vault port to your local machine port using the following command:

    CODE 
    kubectl port-forward --namespace YOUR_NAMESPACE_NAME service/vault 8200:8200

  2. Open a browser window and navigate to http://localhost:8200/ URL.

  3. Log in using the Vault Token.

  4. After successful login, please click Enable new engine.

  5. Select KV, then click Next.

  6. Change the version to 1. You can keep the path as the default (e.g. /kv).

  7. Click Enable Engine, then click Create Secret.

  8. Provide the path to the secret (e.g. /ot/smb).

  9. Take one of the following actions:

    1. Add the key-value pair required for your Data Source authentication

    2. Toggle on JSON to enter the Credential details in JSON format.

  10. Note:

    Note down the full path of the secret stored in vault, in this case it is /kv/ot/smb.