To connect to Salesforce using a Time-Base One-Time-Pad (TOTP) Authenticator code, CopyStorm can be configured with:

1. A TOTP Authenticator App Code.

   1. https://help.salesforce.com/s/articleView?id=sf.add_time-based_token.htm&type=5

2. The username and password for the Salesforce instance.

Enabling TOTP Authentication in CopyStorm

TOTP authentication can be enabled in CopyStorm by selecting the “One-Time Password Authenticator” credential type:

To configure a TOTP Security Key in Salesforce:

1. Open the User Details page.

2. Click on the link to Connect a One-Time Password Authenticator.

3. Select “I Can’t Scan the QR Code”.

4. Copy the Key into CopyStorm.

For developers, a useful way to provide CopyStorm with Salesforce credentials is via a SFDX username or alias. When an SFDX username is provided, CopyStorm calls out to SFDX to create the a Salesforce session token, relying on SFDX to do all of the OAuth dirty work!

Step 1: Change the CopyStorm credential type to SFDX Username or Alias.

Step 2: Enter an SFDX username or alias.

As a final step, optionally test the connection using the Test Salesforce Connection button.

As a best practice, we recommend using an SFDX alias rather than a username in order to support easier reuse when new scratch orgs are created.

CapStorm applications connect to Salesforce using several supported OAuth login types. This section covers the available options:

Each flow offers a different approach to authentication depending on how your Salesforce org is configured.

To connect to Salesforce using the OAUTH CLIENT CREDENTIALS flow, CopyStorm can be configured with:

1. The OAuth Client ID

2. The OAuth Client Secret

OAuth Client Credentials can be enabled in Salesforce by following this tutorial.

OAuth Client Credential logins can be enabled in CopyStorm by navigating to the Advanced Parameters dialog on the Main tab:

After selecting the OAuth 2.0 Client Credentials login type, provide the credentials needed to authenticate with Salesforce:

To connect to Salesforce using the , CopyStorm can be configured with:

1. OAuth Client ID

2. OAuth Client Secret

3. Username

CopyStorm supports reading Salesforce credentials from a user-supplied Salesforce password manager.

This feature was introduced when a customer had strict rules on password changes for service accounts in Salesforce and did not want to:

• Change the saved password in many CopyStorm configuration files.

• Provide the password to CopyStorm on the command line due to security rules.

Since this customer used their own company-wide password manager, an extension was added to CopyStorm to allow them to retrieve password information directly from their password manager instead of from CopyStorm configuration files or the command line.

This article describes how to add a new custom password manager to CopyStorm.

The process to add a new Salesforce password manager to CopyStorm is to:

1. Write a Java class that extends the class com.aslan.sfdc.connect.credentials.AbstractSalesforceUserPasswordCredentials.

2. Package the new Java class in a jar and place it in the “lib” subdirectory of the CopyStorm installation.

3. Add a new CredentialsRegistry.xml file to CopyStorm’s config directory to register the new credential manager with CopyStorm.

The Java class needs to extend com.aslan.sfdc.connect.credentials.AbstractSalesforceUserPasswordCredentials, and will need to override/implement the following methods:

In addition to the required methods above, there are several convenience methods which may be used by credential managers:

CopyStorm discovers all available Salesforce Password Managers by looking for a file named “CredentialsRegistry.xml” in the CopyStorm config directory.

The following CredentialsRegistry.xml file will load a new password manager named “Keyring”:

Click Here to view the Java source of Capstorm’s built-in Keepass Salesforce password manager.

By default, CopyStorm does not store Salesforce or database passwords. To enable this option, select the “Store Passwords” option when saving a configuration file. When checked, CopyStorm will maintain Salesforce password security by encrypting Salesforce and database passwords in the save file.

What if I Want to Store Passwords in a Password Manager?

CopyStorm includes an extensible system which allows the usage of third-party password managers to store Salesforce passwords. The default password storage locations include:

• Directly within the CopyStorm save file (this is the default).

• Within a KeePass file named “passwords.kdbx” located in any of:

  • The user’s home directory.

  • The CopyStorm installation directory.

  • A subdirectory of the CopyStorm installation directory named “config”.

  • Any directory adjacent to the CopyStorm installation directory.

To use your own password manager, please see our tutorial titled .

To enforce Salesforce password security using the KeePass password manager to authenticate with Salesforce, you will need:

• A kdbx (KeePass v2.x) formatted password file containing the username and password of the Salesforce user.

  • For more information on the KeePass password manager, see

  • The user’s Security Token may be either:

    • Appended to the user’s password.

After installing Perl with the kpcli dependencies:

• Put the passwords.kdbx file in one of the locations referenced above.

• Put the kpcli.pl script in one of the locations referenced above (make sure the file is named “kpcli.pl”).

• Make sure the script is installed correctly by running the command:

CopyStorm supports reading Database credentials from a user-supplied Database password manager.

This feature was introduced to eliminate the need to:

• Change the saved password in many CopyStorm configuration files.

• Provide the password to CopyStorm on the command line due to security rules.

In addition to security benefits, this feature allows you to use your own company-wide password manager.

Feature Overview

The process to add a new Database password manager to CopyStorm is to:

1. Write a Java class that extends the class com.aslan.sfdc.connect.credentials.AbstractJDBCUserPasswordCredentials

2. Package the new Java class in a jar and place it in the “lib” subdirectory of the CopyStorm installation.

3. Add a new CredentialsRegistry.xml file to CopyStorm’s config directory to register thenew credential manager with CopyStorm.

The Java class needs to extend com.aslan.sfdc.connect.credentials.AbstractJDBCUserPasswordCredentials, and will need to override/implement the following methods:

In addition to the required methods above, there are several convenience methods which may be used by credential managers:

Click Here to view the Java source of Capstorm’s built-in Keepass Database password manager.

How to Login to Salesforce as an External Client App

This page provides instructions for connecting to Salesforce using certificate-based / JWT authentication.

To connect to Salesforce using JWT authentication it is necessary configure an External Client App with a certificate, and to provide the certificate and OAUTH Client Id to CapStorm.

Step 1: Create a Certificate

Create a certificate using CapStorm by selecting the JWT credential type and exporting the certificate file.

To select the JWT credential type:

1. Click on the Edit button for Advanced Parameters.

2. Select Oauth 2.0 JWT in the dropdown.

To Save the certificate:

This will create two files:

1. The certificate and private key are stored in a file CapStorm_JWT.jks in the CapstormConfig folder.

   1. The CapstormConfig folder is a folder next to the application folder.

   2. For example, if CopyStorm is installed in C:\CapStorm\CopyStorm

   3. Then the CapstormConfig folder will be C:\CapStorm\CapstormConfig

Create an External Client App using the PEM file exported in Step 1.

Login to Salesforce and go to Setup. Search for External Client App Manager in the Quick Find box, and click on New External Client App.

Enter app details:

1. External Client App Name

2. API Name

3. Contact Email

4. Callback URL

Then, click on “Create”.

After creating the External Client App, configure app policies to allow access.

Click on “Edit” for App Policies, and update the policy to enable appropriate users. In this example, a Permission Set is used to grant access to the app:

1. Under OAuth Policies, change Permitted Users to:

   1. Admin approved users are pre-authorized.

2. Under Select Profiles and Select Permission Sets:

   1. Select the Permission Set(s) or Profile(s) that should be granted access to the External Client App.

To configure CapStorm, the Oauth Client Id (Consumer key) from the External Client App will be needed.

1. Go to the Settings tab of the External Client App.

2. Under OAuth Settings, click on Consumer Key and Secret.

3. In the Consumer Details page, copy the Consumer Key.

Copy the Consumer Key:

Now, to finish configuring CapStorm:

1. Copy the Consumer Key value into the OAuth Client Id text box.

2. Enter the Salesforce User’s username into the Username text box.

   1. The user must be a member of the Permission Set or Profile configured in the OAuth policy.

3. Enter the Salesforce instance’s host name into the Salesforce Host text box.

To verify the connection, click on the “Test Salesforce Connection” button. If successful, the below window will appear:

The custom certificate checkbox allows users to create and use their own custom java keystore file, separate from the built-in Java JRE keystore. By enabling this checkbox, several new fields will appear in the login form:

The process of configuring OAuth JWT login with a custom certificate is largely similar to the above steps, the main differences being:

• OAuth Public and Private keys will need to be generated manually

• The Certificate will need to be generated manually from the public and private keys

• The certificate will need to be added to a java keystore file or a PKCS12 file

• Keystore info (file path, keystore password, key password, and name) must be entered manually into CopyStorm

After manually generating the above keys and files, the rest of the setup is largely similar to the non-custom certificate flow. Create an external client app, upload the certificate to the external client app, configure the external client app, and finally configure CopyStorm.

For more information on generating keys and certificates for use in Salesforce OAuth JWT, see this .

To connect to Salesforce using the OAUTH JWT flow, CopyStorm can be configured with:

1. The OAUTH Consumer Key and Certificate.

2. The username and endpoint for the Salesforce instance.

JWT Authentication can be enabled in Salesforce by following this tutorial. The overall process is to:

1. Create a Connected Application.

2. Configure Mutual Authentication, including a Digital Signature and appropriate OAuth Scopes.

3. Update the Connected Application Policies to allow appropriate users to login to Salesforce.

OAUTH logins can be enabled in CopyStorm by going to the Advanced Parameters dialog on the Main tab:

After selecting the Oauth 2.0 JWT login type, provide the credentials needed to authenticate with Salesforce: