{"id":5322,"date":"2016-02-15T04:20:02","date_gmt":"2016-02-15T04:20:02","guid":{"rendered":"http:\/\/www.jitendrazaa.com\/blog\/?p=5322"},"modified":"2016-02-15T04:33:43","modified_gmt":"2016-02-15T04:33:43","slug":"storing-secrets-or-passwords-in-salesforce-video","status":"publish","type":"post","link":"https:\/\/www.jitendrazaa.com\/blog\/salesforce\/storing-secrets-or-passwords-in-salesforce-video\/","title":{"rendered":"Storing secrets or passwords using manage package in Salesforce – Video"},"content":{"rendered":"

Salesforce supports\u00a0Encrypted Field\u00a0<\/strong>out of the box on standard or custom objects. However, users with appropriate profile or permission set can easily view content of those fields. If we want to store secure information like passwords (of external systems), then there is no direct way to achieve this. If we think about passwords, no one should be able to view it. If we forget password, then instead of system sending old password, it forces us to reset it.<\/p>\n

We will create same behaviour in Salesforce where stored password cannot be viewed by anyone.<\/p>\n

\"Storing<\/a>
Storing Passwords in Salesforce<\/figcaption><\/figure>\n

We will need a developer org with any namespace. In my case, namespace is “Livecoding”. Namespace can be created from “Setup | Build | Create | Packages | Developer Settings | Edit”. We need namespace so that\u00a0manage package<\/strong> can be created. Idea is to have a\u00a0protected custom setting. <\/strong>Protected custom setting can only be accessed in manage package and we will create\u00a0global class,\u00a0<\/strong>which can be used in subscriber (Client) org to perform various operations related to storing and getting passwords.<\/p>\n

I have created custom setting by name “Livecoding__secrets__c” (Livecoding is namespace added by default in API name). Field of type text is created to store password by name “Livecoding__Password__c”.<\/p>\n

To perform various operations, below global class is created with three methods:<\/p>\n

\r\n\/**\r\n * \t@Author\t\t\t:\tJitendra Zaa\r\n * \t@Date\t\t\t:\t13-Feb-2016\r\n * \t@Description\t:\tVarious operations to be performed on passwords\t\r\n * \r\n * *\/\r\nglobal class Operations {\r\n    \r\n    \/**\r\n     * To store username and secret, use this method\r\n     * *\/\r\n    global static void addSecrets(String username, String password){\r\n        \r\n        Livecoding__Secrets__c obj = new Livecoding__Secrets__c(name = username, Livecoding__Password__c= password);\r\n        insert obj;\r\n    }\r\n\r\n\t\/**\r\n\t * This method checks if password entered is correct or not \r\n\t * *\/    \r\n    global static boolean isPasswordCorrect(String username, String password)\r\n    { \r\n        \/\/read custom setting using SOQL\r\n        List<Livecoding__Secrets__c> lstRecords = [SELECT ID FROM Livecoding__Secrets__c WHERE Name = :username AND  Livecoding__Password__c =: password ];\r\n        \r\n        if(lstRecords.isEmpty())\r\n        {\r\n            return false;\r\n        }\r\n        return true;\r\n    }\r\n    \r\n    \/**\r\n     * Reset password of existing user \r\n     * *\/\r\n    global static boolean resetPassword(String username, String password){\r\n        \r\n        \/\/read custom setting without SOQL\r\n        Livecoding__Secrets__c userRecord = Livecoding__Secrets__c.getValues(username);\r\n         \r\n        if(userRecord == null)\r\n        {\r\n            return false;\r\n        }\r\n        \r\n        userRecord.Livecoding__Password__c = password ;\r\n        update userRecord; \r\n        \r\n        return true;\r\n    } \r\n}\r\n<\/pre>\n
To create manage package, we must need to have minimum 75% of test coverage. Below test class gives 100% test coverage to our manage package.<\/p>\n
\r\n\/**\r\n * \t@Author\t\t\t:\tJitendra Zaa\r\n * \t@Date\t\t\t:\t13-Feb-2016\r\n * \t@Description\t:\tTest class for "Operations"\r\n * *\/\r\n\r\n@isTest\r\npublic class OperationsTest {\r\n\t\r\n    \r\n    @testSetup \r\n    static void setupCustomSetting() {\r\n        Livecoding__Secrets__c obj = new Livecoding__Secrets__c(name = 'abc@livecoding.tv', Livecoding__Password__c= 'sample1');\r\n        insert obj;\r\n\t}\r\n    \r\n    \r\n    static testMethod void addSecrets_Test(){\r\n        Operations.addSecrets('xyz@livecoding.tv','xyz');\r\n        \r\n        List<Livecoding__Secrets__c> lstCustomSettings = Livecoding__Secrets__c.getAll().values();\r\n        System.assertEquals(lstCustomSettings.size(), 2);  \r\n    }\r\n    \r\n    static testMethod void isPasswordCorrect_No_Test(){\r\n        boolean retValue = Operations.isPasswordCorrect('abc@livecoding.tv', 'password') ;\r\n        System.assertNotEquals(retValue, true) ;        \r\n    }\r\n    \r\n    static testMethod void isPasswordCorrect_Yes_Test(){\r\n        boolean retValue = Operations.isPasswordCorrect('abc@livecoding.tv', 'sample1') ;\r\n        System.assertEquals(retValue, true) ;        \r\n    }\r\n    \r\n    static testMethod void resetPassword_No_Test(){\r\n        boolean retValue = Operations.resetPassword('abc@livecoding.com', 'password') ;\r\n        System.assertEquals(retValue, false) ;  \r\n    }\r\n    \r\n    static testMethod void resetPassword_Yes_Test(){\r\n        boolean retValue = Operations.resetPassword('abc@livecoding.tv', 'password') ;\r\n        System.assertEquals(retValue, true) ;  \r\n        \r\n        retValue = Operations.isPasswordCorrect('abc@livecoding.tv', 'password') ;\r\n        System.assertEquals(retValue, true) ;    \r\n    }    \r\n}\r\n<\/pre>\n
In above test class, we have used\u00a0@testSetup<\/strong> method. It is used to create a common test records being used by all\u00a0testmethod<\/strong>. This method is implicitly called before each testmethod in class.<\/p>\n
It’s time to create\u00a0Manage package<\/strong> now. Navigate to “Setup | Build | Packages | New”. This manage package will have below three components<\/p>\n
    \n
  1. Protected public setting<\/li>\n
  2. Global Apex class to perform operations on Custom Setting<\/li>\n
  3. Test class for Apex to cover minimum 75%<\/li>\n<\/ol>\n
    If we need to store password in any org, we can install above manage package in that\u00a0org.\u00a0To perform operations related to password, we can use any of three global methods available in manage package.<\/p>\n
    Other resources:<\/strong><\/p>\n