Connect Salesforce

This page describes how to connect Salesforce to Agentspace.

We recommend using the Salesforce V2 (Recommended) connector to ingest Salesforce data into Agentspace. The existing Salesforce connector will be deprecated. If you are using an existing data store that uses the Salesforce connector, create a new data store using the Salesforce V2 connector.

Connect Salesforce V2 (Recommended)

Supported versions

The Salesforce V2 connector supports SOAP API version 30.0 or later.

Before you begin

Before setting up your connection, do the following:

1. Use either a Salesforce enterprise or a Salesforce developer plan. Trial accounts are not supported.

2. Configure Salesforce for connectivity based on your chosen authentication type. Supported authentication types are:

   • Username and password

   • OAuth 2.0 - JWT bearer

   • OAuth 2.0 - Client credentials

Generate a service attachment

Use the following steps to generate a service attachment:

• For Publicendpoint: If the Salesforce data center Destination typeis Public, you are not required to create the setup for service attachment. Instead, you can use your public URL in the Domain URLfield of the Google Cloud console.

• For Privateendpoint:

  1. Use PSC to enable connections from private instances to Google Cloud.
  2. Create a Virtual Private Cloud network and the required subnets.
  3. Create a Virtual Machine (VM) instance and install the backend service.
  4. Optional: Set up a health check probe to monitor backend health.
  5. Add a load balancer to route traffic to the VM or backend.
  6. Define firewall rules to allow traffic between the PSC endpoint and the backend.
  7. Publish the endpoint by creating a PSC service attachment.

Configure Salesforce for connectivity

To connect a Salesforce data source to Agentspace, you must complete specific configurations within Salesforce. These configurations vary based on the authentication type you choose.

Set up for username and password authentication

For username-password authentication, use an existing security token, or reset the security token to receive a new one in your registered email.

To reset your security token:

1. Click your profile icon and select Settings.

   

2. Navigate to the Reset my security tokentab and click Reset security token.

   

   Salesforce sends the new security token to your registered email.

Set up for OAuth 2.0 - JWT bearer authentication

You must set up Vertex AI Search as a connected app in Salesforce for API integration.

After you connect Vertex AI Search as a connected app, you can obtain the following authentication information that is needed to create a Salesforce connector in Agentspace.

• Customer key
• Public key
• Username (pre-authorized to use the application)

Generate private key and public certificate

1. Execute the following OpenSSL command to generate a 2048-bit RSA private key.

   openssl genrsa -out server.key 2048

   This command creates a file named server.key , which contains your private key. Keep this file secure and confidential.

2. Execute the following OpenSSL command to generate a self-signed public certificate using the private key.

   openssl req -new -x509 -sha256 -days 3650 -key server.key -out server.crt

   This command generates a file named server.crt , which is your public certificate. You can upload this certificate to Salesforce during the connected app configuration.

Create and configure connected app in Salesforce

1. In your Salesforce app, click the setup icon, and then select Setup.

   

2. Enter Apps in the quick find box and select App manager.

3. Select New external client app.

   

4. Enter the required basic information for your connected app, such as the External client app name, API name, and Contact email.

5. In the API (Enable OAuth settings)section, configure the following OAuth settings. For more information, see Enable OAuth Settings for API Integration .

   1. Select the Enable OAuthcheckbox.
   2. Enter the Callback URLas https://vertexaisearch.cloud.google.com/console/oauth/salesforce_oauth.html .
   3. In the Selected OAuth scopessection, add Full access(full), Manage user data via APIs (api), and Perform requests at any time (refresh_token, offline_access). For more information, see OAuth Tokens and Scopes .

   4. In the Flow enablement section:

   5. Select the Enable JWT bearer flowcheckbox.

   6. Upload the public certificate created in Generate private key and public certificate .

      

   7. Click Create.

Pre-authorize external client app access

After creating the Connected App, you must explicitly authorize specific users or permission sets to access it.

1. Enter External client app in the quick find box and select External client app manager.
2. Locate and open the external client app that you created earlier.
3. In the Policiestab, click Editto modify the app details.

4. In the OAuth policiessection, do the following:

   1. In the Permitted usersfield, select Admin approved users are pre-authorized.
   2. In the Refresh token policyfield, select Refresh token is valid until revoked.
   3. In the IP relaxationfield, select Relax IP restrictions.

      

   The IP relaxation option controls whether the connected app's access is limited by IP ranges. IP restrictions are enforced based on the user profile settings. You must verify if an organization-wide IP range enforcement is active in the user settings. If Enforce login IP ranges on every requestis enabled, then setting IP Relaxation to Relax IP restrictionsdoes not override the existing IP restrictions. For more information, see Connected App IP Relaxation and Continuous IP Enforcement .

   • If you want to enforce IP restrictions in the connected app, set up a trusted IP. For more information, see Configure Trusted IP Ranges for a Connected App .
   • If you don't want to have any IP access restrictions, verify that the Enforce login IP ranges on every requestisn't selected.

5. In the App policiessection, select the profiles and permission sets for which this authentication type needs to be authorized.

   

6. Click Save.

7. Navigate to the Settingstab.

8. In the OAuth settingssection, click Consumer key and secretand copy the Consumer key and Consumer secret .

Set up for OAuth 2.0 - Client credentials authentication

You must set up Agentspace as a connected app in Salesforce for API integration.

After you connect Agentspace as a connected app, you can obtain the following authentication information that is needed to create a Salesforce connector in Agentspace.

• Consumer ID or client ID
• Consumer secret or client key

Create and configure an external client app

1. In your Salesforce app, click the setup icon, and then select Setup.

2. Enter Apps in the quick find box and select App manager.

3. Select New external client app.

4. Enter the required basic information for your connected app, such as the External client app name, API name, and Contact email.

5. In the API (Enable OAuth settings)section, configure the following OAuth settings. For more information, see Enable OAuth Settings for API Integration .

   1. Select the Enable OAuthcheckbox.
   2. Enter the Callback URLas https://vertexaisearch.cloud.google.com/console/oauth/salesforce_oauth.html .
   3. In the Selected OAuth scopessection, select Full access(full), Manage user data via APIs (api), and Perform requests at any time (refresh_token, offline_access). For more information, see OAuth Tokens and Scopes .
   4. In the Flow enablement section, select the Enable client credentials flowcheckbox.

      

6. Click Create.

Pre-authorize external client app access

After creating the external client app, you must explicitly authorize specific users or permission sets to access it.

1. Enter External client app in the quick find box and select External client app manager.
2. Click the name of the external client app that you created.
3. In the Policiestab, click Editto modify the app details.

4. In the OAuth policiessection, do the following:

   1. In the Permitted usersfield, select Admin approved users are pre-authorized.

   2. In the OAuth flow and external client enhancementsection:

      1. Select the Enable client credentials flowcheckbox.
      2. Enter the user's email ID.

   3. In the Refresh token policyfield, select Refresh token is valid until revoked.

   4. In the IP relaxationfield, select Relax IP restrictions.

      

   The IP relaxation option controls whether the connected app's access is limited by IP ranges. IP restrictions are enforced based on the user profile settings. You must verify if an organization-wide IP range enforcement is active in the user settings. If Enforce login IP ranges on every requestis enabled, then setting IP Relaxation to Relax IP restrictionsdoes not override the existing IP restrictions. For more information, see Connected App IP Relaxation and Continuous IP Enforcement .

   • If you want to enforce IP restrictions in the connected app, set up a trusted IP. For more information, see Configure Trusted IP Ranges for a Connected App .
   • If you don't want to have any IP access restrictions, verify that the Enforce login IP ranges on every requestisn't selected.

5. In the App policiessection, select the profiles and permission sets for which this authentication type needs to be authorized.

   

6. Click Save.

7. Navigate to the Settingstab.

8. In the OAuth settingssection, click Consumer key and secret, then copy the Consumer key and Consumer secret .

Get login URL

To get the Login URL for your Salesforce instance, do the following:

1. Enter My domain in the quick find box and select My domain.
2. Copy the domain that ends in my.salesforce.com .
3. Add https:// to the beginning of the copied domain. This is the instance URL that you need when you create the Salesforce connector in Agentspace. The instance URL must be in the following format: https:// DOMAIN_NAME .my.salesforce.com .

Configure user minimum permissions

To verify that the user configuring the connector has the required minimum data fetching permissions, complete the following steps:

1. Enter Profiles in the quick find box and select Profiles.
2. Select the user profile running the connector.
3. Navigate to the Standard object permissionssection and verify the permissions.

Verify that the selected user has access to the permissions. This process must be repeated for each entity you intend to ingest. This involves checking whether the default access at the user's profile level is set to Private . When an entity's access is set to Private , your Google Cloud connector can't access the required object and registers an error in Cloud Logging. To allow access, do the following:

1. Create a permission set and share it with the user

   1. Enter Permission sets in the quick find box and select Permission sets.

   2. Click New.

   3. Enter a name and save the permission set.

   4. Open the created permission set and navigate to the Appssection.

   5. Select Object settings.

   6. Select the View all recordscheckbox.

   7. In the Field permissionssection, grant read access to all fields you want to synchronize.

      

   8. Save the settings and navigate back.

   9. In the System section, select System permissions.

   10. Enable the following minimum permissions:

       • API enabled

       • View all users

       • View roles and role hierarchy

       • View setup and configuration

2. Add the user to the permission set:

   1. Enter Users in the quick find box and select Users.

   2. Select the user.

   3. In the Permission set assignmentssection, select Edit assignments.

   4. Add the recently created permission set to the Enabled permission setssection.

For more information, see Data access in Salesforce and Organization-Wide Sharing Defaults .

Create a Salesforce V2 data store

Rate limits

The default rate limit for the Salesforce connector is 5 requests per second.

Error messages

The following table lists the error messages that you might get when you use the Salesforce connector:

Known limitations

• Category based access control lists for knowledge article versions are not supported.

• Tasks are only visible to users with View All Datapermission, task owners, and those who have access through the hierarchy.

• When you add a project to a VPC Service Controls (VPC-SC) perimeter after you create a connection, the connector sync run fails.

Connect Salesforce (V1)

Before you begin

Before setting up your connection, do the following:

1. Use either an Enterprise or a Developer plan. Trial accounts are not supported.
2. Set up access control for your data source. For information about setting up access control, see Use data source access control .
3. Verify that the Salesforce CORS allowlist contains Google Cloud.
   1. To configure the allowlist, see Enable CORS for OAuth Endpoints .
   2. To include Google Cloud, add https://console.cloud.google.com/ as the source URL, and save your configuration.

Create a connected app in Salesforce

You must set up Vertex AI Search as a connected app in Salesforce for API integration.

After you connect Vertex AI Search as a connected app, you can obtain the following authentication information that is needed to create a Salesforce connector in Agentspace.

• Instance URL
• Consumer ID or client ID
• Consumer secret or client key

To enable OAuth 2.0 and obtain the authentication information, do the following:

1. In your Salesforce app, click the setup icon, and then select Setup.

   

2. Enter External Client App in the Quick Findbox and select External Client App Manager.

3. In the menu, go to Settings.

4. Turn the Allow creation of connected appstoggle to the on position and click New Connected App.

   To do so, you must have the correct permissions for external client apps. Verify whether you have the following permissions:

   • Create, edit, and delete external client apps
   • View all external client apps
   • View all external client apps, view their settings, and edit their policies

   

5. In the creation page for the new connected app, add the basic information for your app, such as the app name, your contact details, and a logo to identify your app. For more information, see Configure Basic Connected App Settings .

6. In the API (Enable OAuth Settings)section, configure the following OAuth settings. For more information, see Enable OAuth Settings for API Integration .

   

   1. Select Enable OAuth Settings.

   2. Specify the callback URL as https://vertexaisearch.cloud.google.com/console/oauth/salesforce_oauth.html .

   3. In the Selected OAuth scopessection, add Full Access(full)and Perform request at any time (refresh_token, offline_access). For more information, see OAuth Tokens and Scopes .

   4. Select Enable Client Credentials Flow.

   5. Select Enable Authorization Code and Credentials Flow.

   6. Select the Require user credentials in the POST body for Authorization Code and Credentials Flow.

   7. In Custom connected app handler, specify a Run asuser. This user must have read permissions to all the entities that the user needs the connector to extract.

      

7. Click Saveto create the connected app.

8. Enter Manage connected apps in the Quick Find box and select Manage connected apps.

9. Find your app in the list, select Edit, and then on the connected app details page select Edit policiesto configure the following details:

   

   1. Set IP Relaxationto Relax IP restrictions.

      

      This option determines whether the access to the connected app is restricted by IP ranges. IP restrictions are enforced based on how they're set in the user profile. You must verify whether an organization-wide IP ranges enforcement is configured in the user settings. If Enforce login IP ranges on every requestis enabled, then setting the IP Relaxationoption to Relax IP restrictionsdoesn't remove the IP restrictions. For more information, see Connected App IP Relaxation and Continuous IP Enforcement . If you want to enforce IP restrictions in the connected app, set up trusted IP. For more information, see Configure Trusted IP Ranges for a Connected App If you don't want to have any IP access restrictions, verify that the Enforce login IP ranges on every requestisn't selected.

   2. Set Refresh Token Policyto Refresh token is valid until revoked.

   3. Set Permitted Usersto All users may self-authorize.

   4. In the Client Credentials Flowsection, specify a Run Asuser. The specified user must have read permissions to all the entities that they need the connector to extract. To check whether the user you selected has all the required permissions, do the one of the following:

      1. In your Salesforce app, click the setup icon, and then select Setup.
      2. In the main menu, click Usersand click the username whose permissions you want to verify.
      3. Click Profiles, go to the Standard object permissionssection and verify the permissions.

         

   5. Verify that the selected user has access to the permissions. This involves checking whether the default access at the user's profile level is set to Private . When an entity's access is set to Private , your Google Cloud connector can't access the required object and registers an error in Cloud Logging. To allow access, do one of the following:

      • Change the default profile permission to Public .
      • Configure the access to each entity separately in Sharing settings.

        

      • Create a permission set and share the permission set with the user:
        1. Enter Permission sets in the Quick Find box and select Permission sets.
        2. Click New.
        3. Enter a name and save the permission set.
        4. Under System, click System permissions.
        5. Click Edit, select View setup and configuration, and save.
        6. On the Permission setspage, click Manage assignments
        7. Click Add assignments, select the user that you want to assign the permission set to, and then click Assign.
      • For more information, see Data access in Salesforce and Organization-Wide Sharing Defaults .

10. Click Save.

11. Enter OAuth and openID connect settings in the Quick Find box, select OAuth and OpenId Connect Settings, and then enable Allow Authorization Code and Credentials Flows

    

12. Get the instance URL:

    1. Enter My domain in the Quick Find box and select My Domain.

       

    2. Copy the domain that ends in my.salesforce.com .
    3. Add https:// to the beginning of the copied domain. This is the instance URL that you need when you create the Salesforce connector in Agentspace. The instance URL must be in the following format: https://<var>DOMAIN_NAME</var>.my.salesforce.com</var> .

13. Get the consumer ID and consumer key.

    1. Go to App manager, locate your app, and in the options, select View.

       

    2. Click Manage Customer Details.

       

    3. If prompted, verify your identity.

    4. Copy the consumer details.

       

       This is the instance URL that you need when you create the Salesforce connector in Agentspace.

       If Refresh tokenis enabled, ensure that the token is refreshed and that you copy the latest token when you create the Salesforce connector in the Agentspace.

Create a Salesforce (V1) data store

Next steps

• To attach your data store to an app, create an app and select your data store following the steps in Create an app .

• To preview how your search results appear after your app and data store are set up, see Preview search results . If you used third-party access control, see Preview results for apps with third-party access control .

• To enable alerts for the data store, see Configure alerts for third-party data stores .