Named & External Credentials

SALESFORCE ADMIN

Relationship Intelligence uses a Salesforce Named Credential as the callout boundary to EIE. The Real Bots managed package generates its own RS256 signed assertion. The External Credential does not store a username, password, OAuth token, API key, or shared secret.

The setup requires all of the following:

• Named Credential
• External Credential
• Named Principal
• Permission-set principal access
• Permission-set assignment to the running user

Complete the steps below in order.

1. Create or confirm the External Credential

Salesforce Setup → Named Credentials → External Credentials

Authentication is performed by the RS256 assertion generated by the Real Bots package. Do not configure OAuth, Basic Authentication, a username, password, API token, or client secret.

2. Create the Named Principal

1. Open EIE Relationship Intelligence Auth.
2. Scroll to the Principals section.
3. Click New.
4. Enter the values below.
5. Save.

Expected result — the Principals section displays:

Sequence Number: 1
Parameter Name: EIE_RI_Principal
Authentication Status: Unknown

For this Custom External Credential, an Authentication Status of Unknown does not necessarily indicate a failure. Relationship Intelligence does not store a Salesforce username, password, OAuth token, or shared secret in this principal. Authentication is supplied by the package-generated signed assertion.

3. Create or confirm the Named Credential

Salesforce Setup → Named Credentials → Named Credentials

• Keep Generate Authorization Header off because the Real Bots package supplies the signed authorization assertion.
• Do not attach the Salesforce signing certificate as a Named Credential client certificate.
• The Salesforce signing certificate is used by Apex to sign the outbound assertion.
• The ribot namespace must be allowed because the Relationship Intelligence callout originates from the Real Bots managed package.

4. Grant External Credential Principal Access

Salesforce Setup → Permission Sets → Relationship Intelligence

1. Open External Credential Principal Access.
2. Click Edit.
3. Under Available External Credential Principals, select:

EIE Relationship Intelligence Auth - EIE_RI_Principal

1. Move it to Enabled External Credential Principals.
2. Click Save.

If EIE Relationship Intelligence Auth - EIE_RI_Principal does not appear in the Available list, return to the External Credential and confirm that the Named Principal was created. An External Credential without a principal cannot be granted through a permission set.

5. Assign the Relationship Intelligence permission set

From the Relationship Intelligence permission set:

1. Click Manage Assignments.
2. Click Add Assignments.
3. Select every administrator or integration user who will run Relationship Intelligence setup, verification, or discovery actions.
4. Complete the assignment.
5. Confirm the user appears under Current Assignments.

The user running Verify Google Connection must have this permission set assigned. Creating or editing the permission set does not automatically assign it to the current administrator.

Required permissions for verification

Pre-verification checklist

Before selecting Verify Google Connection, confirm:

• The Salesforce signing certificate exists.
• The public certificate is registered in the correct EIE tenant.
• The EIE Certificate KID is populated in Salesforce.
• The External Credential exists.
• The EIE_RI_Principal Named Principal exists.
• The Named Credential references the correct External Credential.
• The Named Credential is enabled for callouts.
• The ribot namespace is allowed.
• Principal access is enabled in the Relationship Intelligence permission set.
• The permission set is assigned to the current user.

Common mistakes

Continue to Verify Google Connection, or review Permissions and Troubleshooting.

Last updated 1 month ago