☁️ Salesforce

Salesforce — provisioning target for users, profiles, permission sets and groups.

Identification

vendor key: salesforce
engine: salesforce
default role: target
type: Out-of-the-box vendor
vendor docs: https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/

Supported auth methods

oauth2_client_credentials
oauth2_auth_code

Importable objects (5)

Object types the wizard offers to import out of the box.

Users

name: users
iga_target: identity
path: /services/data/v60.0/query?q=SELECT+Id,Username,Email,FirstName,LastName,Name,IsActive,Title,Department,ProfileId,UserRoleId,ManagerId+FROM+User

All Salesforce users (active + inactive).

Default field mappings:

IGA field	Expression	Required
`business_id`	`{{ Id }}`	✓
`identity_id`	`{{ Username }}`	✓
`email`	`{{ Email }}`
`first_name`	`{{ FirstName }}`
`last_name`	`{{ LastName }}`
`display_name`	`{{ Name }}`
`function`	`{{ Title }}`
`department`	`{{ Department }}`
`status`	`{{ 'active' if IsActive else 'suspended' }}`
`manager_id`	`{{ ManagerId }}`
`native_account_name`	`{{ Username }}`	✓
`identity_business_id`	`{{ Email\|lower }}`
`is_privileged`	`{{ false }}`
`salesforce_id`	`{{ Id }}`
`profile_id`	`{{ ProfileId }}`
`role_id`	`{{ UserRoleId }}`

Profiles

name: profiles
iga_target: entitlement
path: /services/data/v60.0/query?q=SELECT+Id,Name,Description,UserLicenseId,UserType+FROM+Profile

Salesforce profiles — determine permissions + UI access. One per user.

Default field mappings:

IGA field	Expression	Required
`business_id`	`{{ Id }}`	✓
`name`	`{{ Name }}`	✓
`description`	`{{ Description }}`
`native_identifier`	`{{ Id }}`
`risk_level`	`{{ 'high' if ('Admin' in (Name or '') or 'System' in (Name or '')) else 'low' }}`
`user_type`	`{{ UserType }}`
`privileged`	`{{ 'Admin' in (Name or '') or 'System' in (Name or '') }}`

Permission Sets

name: permission_sets
iga_target: entitlement
path: /services/data/v60.0/query?q=SELECT+Id,Name,Label,Description,LicenseId,IsCustom+FROM+PermissionSet

Permission Sets — fine-grained permissions stacked on top of Profiles.

Default field mappings:

IGA field	Expression	Required
`business_id`	`{{ Id }}`	✓
`name`	`{{ Label\|if_null(Name) }}`	✓
`description`	`{{ Description }}`
`native_identifier`	`{{ Id }}`
`risk_level`	`'medium'`
`is_custom`	`{{ IsCustom\|to_bool }}`

Permission Set Groups

name: permission_set_groups
iga_target: entitlement
path: /services/data/v60.0/query?q=SELECT+Id,DeveloperName,MasterLabel,Description,Status+FROM+PermissionSetGroup

Bundles of permission sets — efficient for role-based access.

Default field mappings:

IGA field	Expression	Required
`business_id`	`{{ Id }}`	✓
`name`	`{{ MasterLabel\|if_null(DeveloperName) }}`	✓
`description`	`{{ Description }}`
`native_identifier`	`{{ Id }}`
`risk_level`	`'medium'`
`status`	`{{ Status }}`

Public Groups

name: public_groups
iga_target: entitlement
path: /services/data/v60.0/query?q=SELECT+Id,Name,DeveloperName,Type+FROM+Group+WHERE+Type+IN+('Regular','Role','RoleAndSubordinates')

Sharing groups — for data-access rules.

Default field mappings:

IGA field	Expression	Required
`business_id`	`{{ Id }}`	✓
`name`	`{{ Name }}`	✓
`description`	`Sharing group type: {{ Type }}`
`native_identifier`	`{{ Id }}`
`risk_level`	`'low'`
`type`	`{{ Type }}`

Onboarding setup checklist

Create a Connected App in Salesforce with the OAuth2 client credentials flow, give it the 'API Enabled' + 'Manage Users' permissions, and retrieve the Consumer Key + Secret.

Estimated time: ~15 min. The wizard exposes this checklist as a drawer (📋 button) during onboarding. See the Onboarding wizard walkthrough for context.