Scanning Salesforce with Microsoft Purview: Access Token Retrieval Error

Question

I am trying to scan a demo Salesforce system that is publicly available over the internet (so no SHIR needed as I see it). However, even when trying out the SHIR as well as AIR to run a scan after registering the Salesforce with the URL, I receive the error message:

Failed to testConnection: Exception when processing request: Connector Exception: Can not retrieve access token. Make sure you specify proper parameters.

This issue seems to be related to the User Name, Password, Connected App Consumer Key, and Consumer Secret combination. I created a connected key vault, and the managed identity of Purview has sufficient read rights (Key Vault Secrets Officer and Key Vault Secrets User) on that key vault, where I created four secrets:

• The concatenated API user password and security token
• The API User Password
• The Consumer Secret of the Connected App
• The security token

I have tried every possible combination and might have overlooked something. According to the Connect to and manage Salesforce in Microsoft Purview documentation:

• Consumer key is selected while creating a credential. (Automatically checked)
• The username of the user that the connected app is imitating is provided in the username input field. (Using an integration user with the permission set for this)
• The password of the user that the connected app is imitating is stored in an Azure Key Vault secret.
  • If the self-hosted integration runtime machine's IP is within the trusted IP ranges for the organization set on Salesforce, only the password of the user is provided.
    • Otherwise, the password and security token are concatenated as the value of the secret. The security token is an automatically generated key that must be added to the end of the password when logging in to Salesforce from an untrusted network. (I also tried through an SHIR with the concatenated password and security token).
      • The consumer key from the connected app definition is provided. This can be found on the connected app's Manage Connected Apps page or from the connected app's definition. (This was taken exactly)
        • The consumer secret from the connected app definition is stored in an Azure Key Vault secret. This can also be found along with the consumer key. (This was taken exactly and stored in the key vault)

I found an older post where some users managed to make it work: Trying to connect purview to salesforce ... - Microsoft Q&A.

Is it necessary to concatenate the user password and security token when using AIR as well? Any input or suggestions would be greatly appreciated!

Answer 1

@Matthias Paul Sobiech

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to accept the answer .

Ask:

I am trying to scan a demo Salesforce system that is publicly available over the internet (so no SHIR needed as I see it). However, even when trying out the SHIR as well as AIR to run a scan after registering the Salesforce with the URL, I receive the error message:

AI ConvertCopy

Failed to testConnection: Exception when processing request: Connector Exception: Can not retrieve access token. Make sure you specify proper parameters.

This issue seems to be related to the User Name, Password, Connected App Consumer Key, and Consumer Secret combination. I created a connected key vault, and the managed identity of Purview has sufficient read rights (Key Vault Secrets Officer and Key Vault Secrets User) on that key vault, where I created four secrets:

• The concatenated API user password and security token
• The API User Password
• The Consumer Secret of the Connected App
• The security token

I have tried every possible combination and might have overlooked something. According to the Connect to and manage Salesforce in Microsoft Purview documentation:

• Consumer key is selected while creating a credential. (Automatically checked)
• The username of the user that the connected app is imitating is provided in the username input field. (Using an integration user with the permission set for this)
• The password of the user that the connected app is imitating is stored in an Azure Key Vault secret.
  • If the self-hosted integration runtime machine's IP is within the trusted IP ranges for the organization set on Salesforce, only the password of the user is provided.

     - Otherwise, the password and security token are concatenated as the value of the secret. The security token is an automatically generated key that must be added to the end of the password when logging in to Salesforce from an untrusted network. (I also tried through an SHIR with the concatenated password and security token).
    
              - The consumer key from the connected app definition is provided. This can be found on the connected app's Manage Connected Apps page or from the connected app's definition. (This was taken exactly)
    
                          - The consumer secret from the connected app definition is stored in an Azure Key Vault secret. This can also be found along with the consumer key. (This was taken exactly and stored in the key vault)
    

I found an older post where some users managed to make it work: Trying to connect purview to salesforce ... - Microsoft Q&A.

Is it necessary to concatenate the user password and security token when using AIR as well? Any input or suggestions would be greatly appreciated!

Solution: So, I actually managed to figure out that it was the configuration of the API user and not the correct token (session instead of security token). After fixing that and double-checking the OAuth settings of the connected app, everything worked as expected, and I was able to use the AIR normally. Thanks again for answering.

If I missed anything please let me know and I'd be happy to add it to my answer, or feel free to comment below with any additional information.

If you have any other questions, please let me know. Thank you again for your time and patience throughout this issue.

---

Please don’t forget to Accept Answer and Yes for "was this answer helpful" wherever the information provided helps you, this can be beneficial to other community members.