Salesforce

Salesforce is a customer relationship management (CRM) system with over 100,000 customers.

You can read and write data from Salesforce services (Sales Cloud, Service Cloud, …) including contacts, leads, opportunities, cases, and reports, then analyze and enrich that data in DSS.

This capability is provided by the “Salesforce” plugin, which you need to install. Please see Installing plugins.

Connections to Salesforce use the Force.com REST API.

It can read:

  • Records/items of an Object.

  • Results of a List View.

  • Results of a SOQL query you define.

  • Results of a Report.

It can write/update any Salesforce records of an Object thanks to a Dataiku custom recipe.

How to set-up

The plugin supports these authentication methods for the Force.com REST API:

  • Salesforce SSO (new in plugin version 1.2.0): connect to Salesforce with a SSO login that is stored in a plugin preset. It uses the per-user credentials mechanism of Dataiku, so all users of the plugin need to authenticate themselves via the SSO. OAuth (SSO) is the default for newly configured connections.

  • Client credentials (plugin version 2.3.0 and later): use an external client app’s consumer key and secret to connect as a designated Salesforce integration user.

  • JWT bearer (plugin version 2.3.0 and later): use a signed assertion to connect as a preauthorized Salesforce user without storing that user’s password.

  • Salesforce login (deprecated): connect to Salesforce with a username and password stored in a plugin preset. This is the deprecated Username-Password authentication method.

  • JSON token (deprecated): use a legacy access token saved in a JSON file. Older saved configurations, including flows created before the authentication selector was available, may omit auth_type; the plugin then falls back to this JSON token method.

Warning

Salesforce will retire the OAuth 2.0 username-password flow for connected apps on February 20, 2027. In this plugin, this affects configurations that use the deprecated Salesforce login with Username-Password or JSON token preset, which will no longer be able to obtain new access tokens.

Check the configured authentication method and migrate configurations using that preset to per-user OAuth (Salesforce SSO), client credentials, or JWT bearer authentication.

See the Salesforce retirement notice.

In any case, you will need to create an Extern Client App in your Salesforce portal. To do so:

  • Go to Setup > Quick Find, search for External Client App Manager”.

  • Create a New External Client App. Name your application, give a contact email.

  • Under API (Enable OAuth Settings), tick the box Enable OAuth.

  • In Selected OAuth Scopes, make all scopes available.

  • Add https://<<your dss instance>>/dip/api/oauth2-callback in the Callback URL box. Save and note down the Consumer Key and the Consumer Secret as you will need them later.

  • Go to Apps > External Connected Apps > External Client App Manager > your app’s name.

  • In the Policies tab, expand the OAuth Policies section and look for the App Authorization sub-section. In Refresh Token Policy, pick either Refresh token is valid until revoked, Expire refresh token if not used for or Expire refresh token after specific time. The duration you add will decide the amount of time your user will be able to access their Salesforce account from Dataiku without having to log in. More details on Apps creation can be found here.

  • Install the plugin in your Dataiku Dataiku instance.

  • Configure the authorization method of your choice.

Salesforce SSO method

  • In Dataiku, go to Apps > Plugins > Salesforce > Settings > Salesforce login with SSO.

  • Create and name a new preset.

  • Find out what is your instance host name, by login in your Salesforce account. The instance host name can be found under your name in the profile section.

  • In the Dataiku preset, fill in the Client ID with your Salesforce’s consumer key, Client secret with your consumer secret, Instance Hostname and save the preset.

  • Each Dataiku user will have to go to Profiles & settings > Credentials and click on the edit symbol corresponding to the right Salesforce preset. This will redirect the user to the Salesforce login page.

Client credentials method

Use client credentials for unattended server-to-server access under a designated Salesforce integration user. Salesforce does not issue a refresh token for this flow.

  • In Salesforce, create an External Client App, enable OAuth and the Client Credentials Flow, and set its Run As user to an integration user with access to the required data. See Salesforce’s client credentials setup.

  • In Dataiku, go to Apps > Plugins > Salesforce > Settings > Client credentials and create a preset. Enter the Instance Hostname of your Salesforce My Domain (for example, company.my.salesforce.com), Consumer key, and Consumer secret. All three values are required.

  • Select Client credentials and the preset when configuring a Salesforce dataset, write recipe, or agent tool. The plugin obtains an access token from the My Domain token endpoint; Salesforce does not support login.salesforce.com or test.salesforce.com for this flow.

JWT bearer method

Use JWT bearer for unattended access as a specific Salesforce user. The plugin signs each token request with an RSA private key; Salesforce verifies it against the corresponding certificate registered with the app. Salesforce does not issue a refresh token for this flow.

  • In Salesforce, configure an External Client App for the JWT bearer flow, register the corresponding X.509 certificate, and preauthorize the user to access the app. See Salesforce’s JWT bearer setup.

  • In Dataiku, go to Apps > Plugins > Salesforce > Settings > JWT bearer and create a preset. Enter the Consumer key, User email of the authorized Salesforce user, and the PEM-encoded Private key that matches the registered certificate. The preset also displays an Instance Hostname field.

  • Select JWT bearer and the preset when configuring a Salesforce dataset, write recipe, or agent tool.

Note

The current JWT bearer implementation sends token requests to login.salesforce.com; its Instance Hostname field does not select a sandbox or My Domain token endpoint.

Salesforce login method (deprecated)

Warning

This method is the deprecated Salesforce login preset covered by the February 20, 2027 retirement notice above.

  • In Dataiku, go to Apps > Plugins > Salesforce > Settings > Salesforce login with Username-Password. Create and name a new preset.

  • Enter all the login details, including email, password and security token (how to find your security token) of a valid Salesforce user.

  • In the permissions, choose the groups of users that can use it. Anyone given access to this preset will be able to connect to Salesforce with this account.

If username-password authentication fails, use per-user OAuth or another supported OAuth flow rather than creating a new password-based connection.

JSON token method (deprecated)

Warning

In flows created before the authentication selector was available the auth_type is not explicitly set, thus defaults to the JSON token method.

This method is deprecated by the February 20, 2027 retirement notice above.

  • In a project, create a new recipe: Salesforce - Refresh the JSON token (legacy).

  • Fill in the consumer key, consumer secret, and all the login details, including email, password and security token (how to find your security token) of a valid Salesforce user.

  • Run the recipe. And you can use the saved token on other components of the plugin.

If username-password authentication fails, use per-user OAuth or another supported OAuth flow rather than creating a new password-based connection.

How to use

Create a new dataset using the Salesforce plugin. Pick an authorization method, define the preset or the token accordingly to the chosen method. Define the fields if necessary. Click on the Test & Get schema button. Then, Save and Explore.

Datasets available with the plugin

  • Salesforce – Objects list: This is mainly to debug and find the objects you can access via the API. Start with this one to make sure that the connection works.

  • Salesforce – SOQL query: Get the results of a defined SOQL query.

  • Salesforce – Object records: Get the records of an Object. An SOQL query is built to query all fields of the object.

  • Salesforce – List View results: Get the results of a List View on an object.

  • Salesforce – Report: Get the results of a report.

More details for the List View results dataset

There are two parameters to define that you can find in the URL when you browse a List View on the portal.

Example: https://eu11.lightning.force.com/one/one.app#/sObject/Opportunity/list?filterName=00B0Y000004Fdd1UAC&a:t=1488295234124

  • Object name: Opportunity

  • List View id: 00B0Y000004Fdd1UAC

More details for the Report dataset

According to the documentation, the report is run immediately and returns the latest summary data for your level of access.

Two restrictions: the report must be in TABULAR format and must be available with a synchronous API call.

How to use the write recipe

The records of a Salesforce object can be added or updated.

  • Prepare a dataset containing the object’s columns to be updated. Only the columns containing changes should be present, and the column names need to already exist in the target Salesforce object.

  • If the column called “Id” is left blank for a given line, a new record will be created. If the id column contains a valid Salesforce record id, it will be updated with the information contained in the other columns.

  • In your Dataiku flow, add a Salesforce – write recipe

  • Select the dataset with the list of object to update as an input, and create a log dataset as an output.

  • Set the relevant authentication method and preset, and type the name of the object to update, and Run the recipe

The output dataset will contain the operation performed (update, new record, error) for each line of the input dataset.

Troubleshooting

How to get logs

Have a look at Dataiku logs: backend.log

You might want to filter: cat /path/to/DATA_DIR/run/backend.log | grep -i "salesforce"

Common error

When trying to authenticate with the JSON token method, I get {“error”:”invalid_grant”,”error_description”:”authentication failure”}

Please make sure that:

  • Your Security Token is still valid.

  • IP restrictions are disabled (or not blocking your IP).

  • Permitted Users is set to “All users may self-authorize”.

  • You’re not using a TLS 1.0 or below. You can debug this with Python script: requests.get("https://www.howsmyssl.com/a/check").text

Resources