→ Read the full article on jitendrazaa.com

This impossible task of integrating two systems seamlessly is done by Digital Engagement. If Digital Engagement is a new product for you, I would strongly recommend reading my previous post, where I covered it in a little bit more detail.

What do you need to set up Digital Experience?

You would need a business that you want to grow by leaps and bounce, its Facebook Page, Salesforce Service Cloud, and Digital Experience add-on license.

Once you got all these, the first step would be to enable Messaging and for that navigate to Setup | Feature Settings | Service | Messaging Settings and enable Messaging.

If you are a video person, feel free to watch the below video as well

Coming back to a blog post, once Messaging is enabled, click on add new Channel and select the Facebook Messenger option as shown below image.

On the next screen, you would be prompted to authenticate to your company’s Facebook account.

On the next screen, you would be provided with a list of all pages of your Facebook account. Select one or multiple pages and provide consent.

From here, we have two choices. Either create a new queue in Service Cloud or reuse an existing one. In the above video, I have created a new queue and did all the basic Service Cloud Setup.

Now, all that is left out is to make sure your Facebook page has a messenger button and start collecting the highest CSAT score possible for your service cloud call center.

Feel free to leave your feedback and comment in this post.

Response was more than expected and questions were high quality. Therefore, I thought to quickly write high level summary of presentation in this blog post along with Youtube video that you can find towards the end of this post.

Firewall, Proxy and Reverse Proxy

Before integrating anything with Salesforce, as per Architect, it is necessary which system components are important for security and may impact with integration pattern to be used.

Firewalls : It controls and protects Malicious Traffics. Firewall can be hardware or software based.

Proxy aka Forward Proxy : Proxy normally configured in your browser or systems like VsCode, data loader, eclipse to hide your actual identity. Every outgoing request transmits through proxy server to make sure external systems unaware about your true origin and identity

Reverse Proxy : Its used by Web Servers and sits before it. It can server any purpose like authentication or perform security related stuff. Best example is Mulesoft where we can configure API proxy which is used to apply throttling, avoiding DoS attacks or applying SLA as per licenses provided to customer

Factors affecting Integration Patterns

At high level, there are five types of integration patterns in Salesforce

1. Request and Reply
2. Fire and Forget
3. Batch Data Synchronization
4. Remote Call In
5. Data Virtualization

1. Request and Reply

Few options available in request & reply integration patterns

• External Services
• LWC, Visual force calling external system
• Callouts from Trigger
• Batch Apex invoking external system

2. Fire & Forget

3. Batch Data Synchronization

4. Remote Call-in

5. Data Virtualization

Youtube Video on Salesforce Integration Pattern

Reference

• Mastering Salesforce DX and VSCode
• Platform Event Basics – Trailhead
• Salesforce Documentation on Integration Patterns
• Implementing External Services – Episode 10 of Path to code
• Integrating Salesforce using Rest API – Episode 8 of Path to code

For Demo purpose, I have enabled my website compatible with Open Search at below URL

https://www.jitendrazaa.com/blog/wp-json/opensearch/1.1/document

Step 1 :

Add External Data Source by clicking New External Data Source.

Provide any suitable name – in this case Jitendra’s Blog.

Select Federated Search : OpenSearch as Type.

Provide this path for OSD (Open Search Document) file format – https://www.jitendrazaa.com/blog/wp-json/opensearch/1.1/document

Click on Validate and Sync.

Step 2 :

Create permission set giving permission to view this External Object and all fields. Assign this permission set to anyone who needs to use search for content outside Salesforce.

We can also enable this federated search in Communities by updating global Search Component and giving community members access to this newly created permission set.

Once above setup is completed – you can search for any term on global search and select External Results as shown in below image :

As discussed in previous post, to use pipe operator as separator. Navigate to Reader Configuration of Transformation message component

and provide required value in separator , In our case, its pipe operator

Mulesoft 4

To use Pipe separator in Mulesoft 4, we need to configure it in File Read component, instead of Transformation message component unlike Mulesoft 3

In this post, we will read Pipe delimited file and upsert record in Salesforce. Instead of upserting record in Salesforce, you can do anything else you want to.

This is how final job will look like :

Pipe delimited file that we want to upload looks like, SAART Account Id is external id that would be used for upsert operation.

NAME|SAART ACCOUNT ID
AT&T|2
IBM|1
Salesforce|3

Step 1 is to bring File component in Mule 3 workspace. only two settings I configured

1. Path
2. File Name in “File Name Regex Filter”

Step 2 is to bring Salesforce component. Configure as shown in below image. In my case I’m going to upsert Account on basis of external Id field SAART Account Id

Step 3 is to bring Transform Message between File and Salesforce component in workspace. Right click on Payload and select Set Metadata

After clicking Set Metadata, below screen will appear. We need to choose CSV as Type and add Headers manually.

Next step is to inform Mule that this CSV file would be delimited using pipe operator. Select Transform message and click on Reader Configuration

when popup comes up, set separator as Pipe (|) operator instead of comma

Step 4 : Bring Logger in workspace to show output of Salesforce operation

Running it : Start Mulesoft and put valid file in folder mentioned in Step 1. Mule will process it, delete it and show log in console.

This session covered below topics

• Introduction to ETL
• What is SQL Server Integration Services (SSIS)
• COZYROC connector
• Demo of extracting and updating records in Salesforce
• Demo of downloading attachments from Salesforce
• Demo of uploading attachments in Salesforce
• Best Practices – How to configure SSIS package to avoid hardcoding
• Best Practices – enabling logging

Recording of Session 

Below image shows “integration mind mapping” used by me. I use it to consider some major aspects while discussing integration approaches with enterprise architects in various meetings. This image is very high level however if you think some more points to be considered or have some other thoughts on same, please share.

1. Data Compliance

Lets start with Compliance part first. It is possible that client has confidential data and doesn’t want to move it to Cloud. In that case, we can expose existing web application of Client using some Salesforce products like “Canvas” or “Lightning Connect”.  For Lightning Connect, data needs to be available on DMZ layer however for Canvas it can exist on Intranet and therefore end users can access data only within office, providing flexibility of cloud and security of intranet.

2. ETL tool

As a best practice for Integration design, loading, transforming and extraction of data should be avoided within Salesforce. Salesforce is multi-tenant architect and therefore has many governor limits. I have seen many projects getting failed because of decision; not to use ETL tool. There may be many reason why ETL may not have been considered, like architect didn’t foresee much in future about its necessity or Client was short on budget. Even though ETL tool adds up some budget but then it opens endless possibilities.

If ETL is considered, then there are some very important question needs to be answered and designed.

a. What will happen if ETL or any System goes down

Software industry is full of possibilities and malfunctioning, no one can be sure about hardware and software design. Business continuity plan is very important to be considered. And this question must be considered in meetings and design “What will happen if ETL goes down” ? Simple answer is declaring clear “Accountability” between systems. Any application can go down or any application can face an error; it could be source System, middle ware or Salesforce. Defining clear accountability of system is very important. Who will be responsible to handle situation if ETL goes down ? Who will be responsible to handle situation if Salesforce goes down, or doesn’t respond in timely manner or some Apex or server error occurs ? We should be having proper error handling and logging mechanism between systems and backup plans as well. For example – If ETL goes down, maintain all request in some “Messaging Queue Server” between Source system and ETL. once ETL comes on-line, start processing queue.

b. Throttling capabilities

When more than two systems are involved in communication, not necessary that both system will perform same. Might be possible that Salesforce could be faster or slower on some unlucky days. We should consider this point as well in our design. Most ETL tool has capability of throttling to make request faster and slower on basis of error or network speed. Personally, I think this is very important in high traffic integration. In one of my project, we had to load (upsert) millions of data in Salesforce on weekly basis. Because of heavy design of Salesforce apex triggers and multiple field update workflows on same object, Salesforce performance was much slower than usual. There were no throttling capabilities and therefore there were lots of loss of data because of various error in Salesforce like “Concurrent Apex limit”, “Unable to lock rows” etc…

c. Priority of incoming and outgoing messages

If we consider “messaging” and “throttling” in our design then most obvious question needs to be considered in “priority of messages”. As message may be sitting in queue, it is possible that some messages should be processed near real time and very important for next system. We should be having logic in “ETL” or “Messaging queue” to decide priority on basis of some message criteria.

3. Fallout reporting capabilities

Either we are going with or without ETL tool, fallout reporting capabilities are very important in integration design. Fallout report may also be referred as “loss in data” report where few message or request has not be processed because of various errors between systems. If we skip this step, validating data accuracy could be very difficult and next to impossible. This may be considered as a part of error and log handling design.

4. API limit considerations

If external system is trying to connect to Salesforce then it is using API limit which is defined for every organization for a 24 hours. We also have a limit on Bulk API per 24 hours. My most of Salesforce implementation project has 3000+ Salesforce users and therefore I have not faced issue with API limit however good to consider in design.

5. Single ETL tool to connect to every applications

This point I know is very debating. I am saying that every application connecting to Salesforce should have single ETL tool where few of you may disagree with me. In one of my project, I had to integrate Salesforce with around 18 Systems. BOOMI was ETL tool of choice and it was used to integrate around 8 systems. Other Systems were integrated using webservices, custom Java tool which implemented BULK API and command line dataloader. We faced lots of issue maintaining and debugging error in all these tools. It would have been very easy if Single ETL tool could be used for all systems. As multiple tools were used, few tool were black box for us and they were using on there Will whenever they wanted to change data inside Salesforce. As discussed above, “Accountability” was main issue. If any tool was failing because of any reason, Salesforce team were to blame in every case and we were on fire .

6. Different user for different System

Lets say, if you are integrating with 10 systems using ETL tool, it is always best practice to have different users for all those system. It has lots of benefit, flexibility and control. We can have different profiles for each user, complete control and easy to debug. Imagine single “integration user” is used to interact with all system, chances of data skew is very high. We cannot switch off user from Salesforce end, hard to configure profile as it may break existing integration and many more.

7. Integration User license

As discussed above, its good practice to have different Salesforce user for different systems. It is not necessary that we need “full Salesforce user license”. If we are not using standard objects then cost can be saved by opting “Force.com app bundle license” or any other suitable Salesforce user license.

8. Data Volume over the time and Data archiving considerations

If you are integrating with multiple systems or not, Data archiving strategy is very important to be considered. There are many advantages of data archiving including improve in performance of reports, list views, global search and saving space of Salesforce. Data archiving can be done using ETL tool or even command line dataloader directly connecting to databases like SQL Server. While designing Data archive strategy, easily getting data back is also very important. Example – using Dataloader, if backup is done in multiple csv files, It would be hard to find record from hundreds of csv files. Even if RDBMS like SQL Server or MySQL is considered, indexing, partition and other performance improvement techniques must be considered. It should not be like one way road where we can archive data but cannot get it back when needed. I have used “DBamp” in many of projects where ETL tools were not used and would recommend to try it out.

9. Single Sign On

This is also very important topic and needs much attention and thoughtful discussion. Salesforce provides lots of option to implement Single Sign On using federated authentication, Delegated authentication or many other Authorization providers. In addition of all APIs available to implement SSO, Salesforce also provides “Identity Connect” which could be considered for SSO implementation. There are many third party applications as well like Ping Identity or Okta. Also, as a best practice, do not enable SSO for System admin users. If something happens with Identity provider or Web services are not responding, end users will be blocked and System admin could still log into system. If we enable SSO for System admin as well then complete Salesforce instance would not be accessible by anyone.

10.  Outbound messages are your best friend

Question is “Are you using or considering Outbound messages ?”. I have seen, many Salesforce implementations where integration could be easily done by using outbound messages instead of Apex callouts. You don’t need to write Apex code, Test classes and polling mechanism if communication fails. Outbound message tries until message is successfully is delivered though there are some design considerations while using Outbound messages.

Please feel free to leave comment and suggestions on this topic so that we can discuss each others experience in integration design and problems.

After writing this article Salesforce has enabled CSP (Content Security Policy) which restricts adding Salesforce in iFrame. We can add MyDomain URL as CSP whitelisting and it works only if user already logged into other Salesforce instance. However, if user is not logged into other instance , internally OAuth navigates through login.salesforce.com which is too restrictive and canvas application fails to load.

In this post we will discuss how Canvas can be used to integrate Salesforce with Salesforce. On my blog we have seen many articles and possibilities to integrate Salesforce with another Salesforce instance like this and this post.

Whats is force.com Canvas

Force.com Canvas SDK from Salesforce allows developers to connect existing legacy system or any web based application with Salesforce using JavaScript and REST API. Canvas applications can be displayed in Chatter, Salesforce Mobile Cards or Visualforce page.

Why we are accessing another Salesforce instance as Canvas app

To get hands on with Canvas, most of article are around creating Heroku applications. I understand there are few developers who are not comfortable with Heroku. So to keep learning curve less, lets use Visualforce page to be exposed as Canvas application after all Visualforce is very advance MVC framework in itself.

Note:

For this blog post, we will need two Salesforce Org. One will act as Identity provider and other will act as Service Provider. I have enabled My Domain and below are information

• https://jitendrazaa5-dev-ed.my.salesforce.com – Service Provider
• https://jitendrazaa2-dev-ed.my.salesforce.com – Identity Provider

Enable My Domain

First step is to enable My Domain in Service Provider Organization. I would suggest name your org with suffix like “spProvider” and “ipProvider” to avoid confusion.

Enable and setup SSO in Service provider Org

You can read this article for more detail on using Salesforce as IDp and SP. Assuming, you already have basic knowledge of SSO, we will jump start.

In Service provider Organization enable SSO by navigating to “Setup | Security Controls | Single Sign-On Settings”.

Download “Self Signed Certificate” from Identity provider by navigating to “Setup | Security Controls | Certificate and Key Management | Create Self Signed Certificate”.

Below image shows configuration of SSO in Service provider organization, In our case domain “jitendrazaa5-dev-ed.my.salesforce.com”.

In above image Issuer is URL of identity provider and Entity Id is URL of current org which is Service provider.

Once we informed Service provider Org that SSO is enabled on basis of federation Id, we need to make sure that Federation Id on user records on both Org must match else SSO will not work and those users will not able to use Canvas application.

Create force.com Canvas application in Identity provider Org

Navigate to “Setup | App Setup | Create | Apps | Connected Apps | New”

As you can see in above setting, Canvas application is enabled for Chatter and Mobile navigation and it uses Visualforce page of Service provider Organization.

Entity Id and ACS URL is copied from SSO settings of Service provided organization.

Creating Visualforce page using Canvas SDK in Service Provider Organization

Instead of using any Heroku or external web based application, we will be using Visualforce page with Canvas SDK. For this, we need to download Canvas SDK from this Github repository and upload it as static resource. In below Visualforce page, we are simply reading Signed request from Identity provider Organization showing capabilities of Canvas SDK as well as we are displaying SessionId, OAuth token and refresh token of Service provider Organization.

As Canvas application is configured to view from Chatter tab, Output will look like :

Source code for Canvas in Salesforce

<apex:page showHeader="false">
    <script type="text/javascript" src="{!URLFOR($Resource.CanvasSDK,'SalesforceCanvasJavascriptSDK-master/js/canvas-all.js')}" />
    <script type="text/javascript">
        var sid="{!GETSESSIONID()}".substr(1,30) +'...';
    	function refreshSR(){
        	Sfdc.canvas.client.refreshSignedRequest(function(data){
                if(data.status == 200){
                	var signedRequest = data.payload.response;
                    var part = signedRequest.split('.')[1];
                    var obj = JSON.parse(Sfdc.canvas.decode(part));
                    updateDisplay(obj) ;
                }
            });
        }

    function updateDisplay(obj){
    	setValue('spSessionId', sid);
        setValue('ipOAuth', obj.client.oauthToken.substr(1,30)+'...');
        setValue('ipUser', obj.context.user.fullName);
        setValue('ipOrg', obj.context.organization.name);
        setValue('ipRefresh', obj.client.refreshToken.substr(1,30)+'...');
    }

    function setValue(eleId,val)
    {
       	var domEl = document.getElementById(eleId);
        if(domEl){
        	domEl.innerHTML = val;
        }
    }

    Sfdc.canvas.onReady(function(){
    	refreshSR();
    });
    </script>

        <b> <u> Service Provider Org </u></b>
        I am Canvas App from Salesforce Domain <b> Jitendra.zaa5@gmail.com </b>
        User : {!$User.FirstName} {!$User.LastName}
        Org : {!$Organization.Name}
        Session Id : <span id="spSessionId"></span>    

<hr />

        <b> <u> Identity Provider Org  - Current Org </u> </b>
        User : <span id="ipUser"></span>
         Org : <span id="ipOrg"></span>
         OAUth Token : <span id="ipOAuth"></span>
        Refresh Token : <span id="ipRefresh"></span>

</apex:page>

Resources

• Canvas example using Nodejs
• List of all Canvas resources
• Developers guide
• Github Canvas SDK repository

What is Named Credential ?

A named credential specifies the URL of a callout endpoint and its required authentication parameters in one definition. You can simplify the setup of authenticated Apex callouts by specifying a named credential as the callout endpoint. You can instead specify a URL as the callout endpoint and register that URL in your organization’s remote site settings. In that case, however, you handle the authentication in your code. Doing so can be less secure and especially complicated for OAuth authentication.

Long description short , “using Named Credential, we can make call out to external system without supplying username or Password”.

To connect with external system using “Named Credential”, we need to follow below steps

1. Create Connected App
2. Create Authorization Provider
3. Define Named Credential
4. Use Apex to connect in 5 lines of code

For first 2 steps, you need to go through this article which explains in detail how to define Connected App and Authorization Provider.

Creating Named Credential

Now, directly start with step 3 to create Named credential by navigating to “Setup | Administer | Security Controls | Named Credentials | New Named Credential “.

Provide below information in settings :

Make sure to check “Start Authentication Flow on Save” and click on Save. After clicking on “Save” new page will open to authenticate Salesforce Org using OAuth2 connected App. If authentication is success, you can see message like “Authenticated as <Salesforce Username>” as shown in below image.

Now execute below code in anonymous Apex and you should be able to see list of all REST API available in Salesforce instance.

HttpRequest feedRequest = new HttpRequest();
feedRequest.setEndpoint('callout:Salesforce_Org/services/data/v32.0');
feedRequest.setMethod('GET');
Http http = new Http();
HTTPResponse feedResponse = http.send(feedRequest);
while (feedResponse.getStatusCode() == 302) {
                feedRequest.setEndpoint(feedResponse.getHeader('Location'));
                feedResponse = new Http().send(feedRequest);
            }
System.debug(feedResponse.getBody());

As you can see in above code, we are not supplying any credentials. syntax to use Named Credential is like

callout:[Named Credential Name]/[Callout URL of other Salesforce Org]

You can consume standard as well custom web-service of other org using this approach.

Error : System.HttpResponse[Status=Moved Temporarily, StatusCode=302]

Sometime you may get above error in Named Credential and that’s why in above code I have added below extra block

while (feedResponse.getStatusCode() == 302) { feedRequest.setEndpoint(feedResponse.getHeader('Location')); feedResponse = new Http().send(feedRequest); }