Setting Up Your Connector in Integrations Hub
First, you'll want to set up your connector in Integrations Hub. Follow the directions laid out in this article. To set up your External Client App in Salesforce, you will need the Process URL from your IH connector.
Setting Up Your External Client App in Salesforce
1. In your Salesforce admin, navigate to your Settings area
2. Search for "External Client App Manager"
3. Click "New External Client App"
4. In the new app, under Basic Information, fill out the required fields (recommendation to call your app "OpenWater SSO" or something similar; Contact Email should be your admin email; Distribution State is Local)
5. Under API (Enable OAuth Settings), check "Enable OAuth":
4. Under App Settings:
In the Callback URL field, add the Process URL from your IH connector
In the scopes, set:
5. Under Flow Enablement section, enable the following options:
6. Under the Security section, keep the default selections as they are, and click "Create" at the bottom
7. After app creation, go to the Policies tab select the App Policies dropdown and click "Edit"
8. Select the start page to be "OAuth" from the drop down and click Save:
9. Under Plugin Policies, choose "All users will self authorize" and add the Process URL to the OAuth Start URL field:
10. Under OAuth Flows and External Client App Enhancements, check "Enable Client Credentials Flow" and "Enable Token Exchange Flow"
"Run As (Username)" should be an admin email with API permissions
11. Under App Authorization, select "Expire refresh token if not used for a specific time" and set for 30 days.
12. Click "Save" at the bottom of the screen and tab over to the Settings tab and click "Consumer Key and Secret"
13. After grabbing your client key (Client ID in IH) and client secret, go back to your IH Connector, and input them in the credentials section (note: the Base URL should be the base URL for your Salesforce instance):
14. Click "Update" and save the connector. You can now test with your own credentials!
Note: after setting up the External Client App, users will likely be asked to authorize their accounts the first time they login. This is normal and expected for Salesforce.