Add Configuration Security by Using Named Credentials

If your organization requires heightened security when making configuration changes, enhance your Data Mask configuration security. Use a named credential with an Auth provider and a connected app to provide a secure connection to the Salesforce Metadata API. This feature is available in Data Mask version 4.2 and later.

Required Editions

Available in: Lightning Experience

Available in: Professional, Enterprise, Unlimited, and Developer Editions with the Salesforce Data Mask managed package (Legacy) add-on license.

User Permissions Needed
To view named credentials:	View Setup and Configuration
To create, edit, or delete named credentials:	Manage Named Credentials or Customize Applications

Note This content relates to the Data Mask managed package. Read about Accelerate and Anonymize in Own from Salesforce.

Note Carefully note certain items during these procedures as required later: Your org’s URL, the generated callback URL, the Consumer Key, and the Consumer Secret.

Data Mask leverages the Metadata API to save configuration data. If your organization enabled the session setting Lock sessions to the IP address from which they originated, you can get an Invalid Session ID error. One solution is to disable the session setting, or use a named credential.

1. From Setup, enter External Client Apps in the Quick Find box, then select Settings in the External Client App section.
2. Turn on Allow creation of connected apps, if it's off.
3. Click New Connected App.
4. Complete the fields.

   Field	Description
   Connected App Name	Data Mask API
   API Name	Data_Mask_API
   Contact Email	Your email, if you’re the Administrator
   Enable OAuth Settings	Select OAuth Settings.
   Callback URL	https://example.com (to be updated later)
   Selected OAuth Scopes	Full Access (full), Perform requests at any time (refresh_token, offline_access)
   Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows	Enable
   Require Secret for Web Server Flow	Enable
   Require Secret for Refresh Token Flow	Enable

5. Save your changes.
6. To view and record the Consumer Key and Consumer Secret for later use, go to Manage Consumer Details.
7. To create an Auth Provider, from Setup, search for Auth Providers in the search box, and then click New.
8. Complete the fields.

   Field	Description
   Provider Type	Salesforce
   Name	Data Mask AP
   URL Suffix	Data_Mask_AP
   Consumer Key	Use the Consumer Key you noted from the Connected App.
   Consumer Secret	Use the Consumer Secret you noted from the Connected App.
   Default Scopes	Add full, refresh_token, offline_access. (Don’t use commas to separate.)

9. Save the Auth Provider, and copy the Callback URL to a clipboard.
10. Edit the Connected App to include the Callback URL provided from the Auth Provider that you saved.
11. To create a named credential, from Setup, select Named Credentials Named Credentials, click the dropdown arrow next to New, and then select New Legacy.
12. Complete the fields.

    Field	Description
    Label	Data Mask NC
    Name	Data_Mask_NC
    URL	The specific login URL for your org (not test.salesforce.com or login.salesforce.com)
    Identity Type	Named Principal
    Authentication Provider	The name of the Auth Provider created earlier
    Start Authentication Flow on Save	Enable
    Generate Authorization Header	Enable
    Allow Merge Fields in HTTP Body	Enable

13. Save the named credential. It’s possible that you must log back into the org and approve the OAuth connection (Allow Access).
14. To update Data Mask Settings, from Setup, search for Custom Settings.
15. Locate Find and Manage Masking Configuration, and click Manage.
16. Under the Masking Configuration section, click Edit, and then enter the name of the named credential Data_Mask_NC in the Named Credential field (no spaces allowed).
17. Save the changes. Now, new or existing configurations are changed securely.