Setting Up Your Connector in Integrations Hub
First, you'll want to set up your connector in Integrations Hub. Follow the directions laid out in this article. To set up your External Client App in Salesforce, you will need the Process URL from your IH connector.
Setting Up Your External Client App in Salesforce
1. In your Salesforce admin, navigate to your Settings area
2. Search for "External Client App Manager"
3. Click "New External Client App"
4. In the new app, under Basic Information, fill out the required fields (recommendation to call your app "OpenWater SSO" or something similar; Contact Email should be your admin email; Distribution State is Local)
5. Under API (Enable OAuth Settings), check "Enable OAuth":
4. Under App Settings:
In the Callback URL field, add the Process URL from your IH connector
In the scopes, set:
5. Under Flow Enablement section, enable the following options:
6. Under Security section, uncheck "Require Proof Key for Code Exchange" (this is enabled by default in Salesforce)
7. Select the App Policies dropdown and click "Edit"
8. Select the start page to be "OAuth" from the drop down and click Save:
9. Under Plugin Policies, choose "All users will self authorize" and add the Process URL to the OAuth Start URL field:
10. Under OAuth Flows and External Client App Enhancements, check "Enable Client Credentials Flow" and "Enable Token Exchange Flow"
"Run As (Username)" should be an admin email with API permissions
11. Under App Authorization, select "Refresh token is valid until revoked"
12. Tab over to Settings and click "Consumer Key and Secret"
13. After grabbing your client key (Client ID in IH) and client secret, go back to your IH Connector, and input them in the credentials section:
14. Click "Update" and save the connector. You can now test with your own credentials!
Note: after setting up the External Client App, users will likely be asked to authorize their accounts the first time they login. This is normal and expected for Salesforce.