This page provides instructions for connecting to Salesforce using certificate-based / JWT authentication.
To connect to Salesforce using JWT authentication it is necessary configure an External Client App with a certificate, and to provide the certificate and OAUTH Client Id to CapStorm.
Create a certificate using CapStorm by selecting the JWT credential type and exporting the certificate file.
To select the JWT credential type:
Click on the Edit button for Advanced Parameters.
Select Oauth 2.0 JWT in the dropdown.
To Save the certificate:
This will create two files:
The certificate and private key are stored in a file CapStorm_JWT.jks in the CapstormConfig folder.
The CapstormConfig folder is a folder next to the application folder.
For example, if CopyStorm is installed in C:\CapStorm\CopyStorm
Then the CapstormConfig folder will be C:\CapStorm\CapstormConfig
Create an External Client App using the PEM file exported in Step 1.
Login to Salesforce and go to Setup. Search for External Client App Manager in the Quick Find box, and click on New External Client App.
Enter app details:
External Client App Name
API Name
Contact Email
Callback URL
Then, click on “Create”.
After creating the External Client App, configure app policies to allow access.
Click on “Edit” for App Policies, and update the policy to enable appropriate users. In this example, a Permission Set is used to grant access to the app:
Under OAuth Policies, change Permitted Users to:
Admin approved users are pre-authorized.
Under Select Profiles and Select Permission Sets:
Select the Permission Set(s) or Profile(s) that should be granted access to the External Client App.
To configure CapStorm, the Oauth Client Id (Consumer key) from the External Client App will be needed.
Go to the Settings tab of the External Client App.
Under OAuth Settings, click on Consumer Key and Secret.
In the Consumer Details page, copy the Consumer Key.
Copy the Consumer Key:
Now, to finish configuring CapStorm:
Copy the Consumer Key value into the OAuth Client Id text box.
Enter the Salesforce User’s username into the Username text box.
The user must be a member of the Permission Set or Profile configured in the OAuth policy.
Enter the Salesforce instance’s host name into the Salesforce Host text box.
To verify the connection, click on the “Test Salesforce Connection” button. If successful, the below window will appear:
The custom certificate checkbox allows users to create and use their own custom java keystore file, separate from the built-in Java JRE keystore. By enabling this checkbox, several new fields will appear in the login form:
The process of configuring OAuth JWT login with a custom certificate is largely similar to the above steps, the main differences being:
OAuth Public and Private keys will need to be generated manually
The Certificate will need to be generated manually from the public and private keys
The certificate will need to be added to a java keystore file or a PKCS12 file
Keystore info (file path, keystore password, key password, and name) must be entered manually into CopyStorm
After manually generating the above keys and files, the rest of the setup is largely similar to the non-custom certificate flow. Create an external client app, upload the certificate to the external client app, configure the external client app, and finally configure CopyStorm.
For more information on generating keys and certificates for use in Salesforce OAuth JWT, see this .
The exported PEM file.
NOTE: This field is required, but the value for Callback URL is not used for JWT Apps.
Enter https://localhost/ as the Callback URL.
OAuth Scopes
At a minimum, the following scopes must be selected:
Access the identity URL service (id, profile, email, address, phone).
Manage user data via APIs (api).
Perform requests at any time (refresh_token, offline_access).
Enable OAuth
This checkbox must be checked.
Enable JWT Bearer Flow
This checkbox allows JWT access.
Certificate Upload
Upload the PEM file that was saved in Step 1.
Click on “Create” to create the External Client App.
CapStorm recommends configuring a Permission Set to limit App access.
Click on “Save” to save the App policies.
Sandboxes will have host names like:
mycompany–mysandboxname.sandbox.my.salesforce.com
Production orgs will have host names like:
mycompany.my.salesforce.com
Click on Test Connection to verify.
Yes
Password used to access the Keystore (blank if the Keystore does not have a password).
Key Name
Yes
The name of the private key used to sign JWT requests.
Key Password
Yes
The password used to access the private key.
OAUTH Client Id
Yes
The Salesforce-generated Client Id for the Connected Application.
Username
Yes
The login Id of the CopyStorm Salesforce user.
Custom Certificate
Unchecked
No
Check this box to use a custom-made Java keystore file (.jks). Leaving the box unchecked will cause the application to use the default Java key store.
Token Validity (minutes)
240
Yes
The lifetime of JWT access tokens. If the token expires during the CopyStorm run, CopyStorm will re-authenticate and get a new token.
Keystore
Yes
Path to a JKS or PKCS12 Keystore containing the private key used to sign JWT requests.
Keystore Password
To connect to Salesforce using the OAUTH CLIENT CREDENTIALS flow, CopyStorm can be configured with:
The OAuth Client ID
The OAuth Client Secret
OAuth Client Credentials can be enabled in Salesforce by following this tutorial.
OAuth Client Credential logins can be enabled in CopyStorm by navigating to the Advanced Parameters dialog on the Main tab:
After selecting the OAuth 2.0 Client Credentials login type, provide the credentials needed to authenticate with Salesforce:
Client ID
The unique identifier issued by Salesforce when you register a connected app. Required for all OAuth flows to identify the requesting application.
Client Secret
A confidential key generated by Salesforce for your connected app. Used alongside the Client ID to authenticate the application during OAuth flows.
CapStorm applications connect to Salesforce using several supported OAuth login types. This section covers the available options:
Each flow offers a different approach to authentication depending on how your Salesforce org is configured.
To connect to Salesforce using the OAUTH CLIENT CREDENTIALS flow, CopyStorm can be configured with:
OAuth Client ID
OAuth Client Secret
Username
Password
OAuth Client Credentials can be enabled in Salesforce by following .
OAuth Client Credential logins can be enabled in CopyStorm by navigating to the Advanced Parameters dialog on the Main tab:
After selecting the OAuth 2.0 Username-Password login type, provide the credentials needed to authenticate with Salesforce:
Client ID
The unique identifier issued by Salesforce when you register a connected app. Required for all OAuth flows to identify the requesting application.
Client Secret
A confidential key generated by Salesforce for your connected app. Used alongside the Client ID to authenticate the application during OAuth flows.
Username
The Salesforce username (email address) of the user the application will authenticate as. This must match a valid, active user in the connected Salesforce org.
Password
The Salesforce password for the specified user. Note: If your org requires it, append the user’s security token directly to the end of the password, with no spaces.
