☁️Salesforce

Managed just-in-time access to Salesforce permission sets

This page documents how to install P0 for a Salesforce organization so you can manage just-in-time access to Salesforce permission sets. Users request a permission set, and P0 assigns it to their Salesforce user when access is approved and removes it when access expires.

The Salesforce integration is in preview. Functionality and configuration may change.

P0 assigns and removes permission sets directly through the Salesforce REST API. This lets P0 revoke entitlements when access expires, which Salesforce's SCIM provisioning does not support.

Before you begin

You need administrator access to your Salesforce organization to complete these steps. In Salesforce:

1. Create a permission set for P0 to use.

2. Grant that permission set the Assign Permission Sets and View All Users permissions.

3. Create an external client application.

4. Add the Manage user data via APIs (api) OAuth scope to the application.

5. Assign the permission set you created to the external client application.

6. Enable the client-credentials flow for the application.

When you create the external client application, Salesforce generates a Consumer key and Consumer secret. You provide these to P0 in the next section.

P0 maps each requestor to a Salesforce user by email address. Every user who requests Salesforce access must already exist as an active Salesforce user whose email matches their P0 identity. P0 assigns permission sets to existing users; it does not create Salesforce users.

Set up the Salesforce integration

1. Open the P0 dashboard at p0.app and log in to your organization.

2. In the sidebar, click Integrations. Under Resources, click Salesforce.

3. Select the Access management component.

4. When prompted for the My Domain name, enter your Salesforce My Domain. P0 builds your login URL from this value as {my-domain-name}.my.salesforce.com.

5. (Optional) If your organization uses a non-standard domain suffix, enter the complete login URL in the Full Salesforce domain field, including the suffix (for example, my-org-domain.foo.my.salesforce.com). P0 uses this value verbatim instead of the default. Leave the field empty to use the default. The value must end with my.salesforce.com.

6. Enter the Consumer key and Consumer secret from your external client application.

7. Click Next to finish.

When you finish installation, P0 validates the credentials by listing your Salesforce users and permission sets. If validation fails, confirm that the P0 permission set has the Assign Permission Sets and View All Users permissions and that the client-credentials flow is enabled.

Use the Full Salesforce domain field only when your login URL doesn't follow the standard {my-domain-name}.my.salesforce.com pattern. The value must end with my.salesforce.com; P0 rejects other domains during installation.

You are ready to make just-in-time requests for Salesforce permission sets with P0. See Requesting Salesforce access.

What P0 grants

P0 grants Salesforce permission sets. A single request can include one or more permission sets. P0 lists all permission sets in your organization except profiles, so users select from your existing permission sets.

To grant least-privileged access, create permission sets that scope access to only the objects, fields, and permissions a user needs, then make those permission sets available through P0. For more information, see Salesforce's documentation on permission sets.

Limitations

• The integration is in preview.

• P0 grants Salesforce permission sets only. Profiles are not available for request.

• Each requestor must already exist as an active Salesforce user whose email matches their P0 identity.