Relationship Intelligence Post-Install Checklist

Complete this checklist after installing or upgrading the Real Bots managed package in a Salesforce tenant that will use Relationship Intelligence. Steps are grouped by administrator responsibility.

Section A — Salesforce administrator

SALESFORCE ADMIN

1. Confirm the managed package

• Current Real Bots managed package version is installed.
• The Relationship Intelligence configuration object is available.
• The Verify Google Connection action is available.
• RIInboundAuth and RelationshipIntelligenceService are installed.
• The Signing Certificate KID field is installed.

2. Confirm Relationship Intelligence components

Salesforce API field for the KID:

ribot__Signing_Certificate_KID__c

3. Create the Salesforce signing certificate

Setup → Certificate and Key Management → Create Self-Signed Certificate

• Label: EIE_RI_Signing
• Unique Name: EIE_RI_Signing
• Use RSA with a supported Salesforce key size.
• Save the certificate.

The private key remains inside Salesforce and is used to sign outbound Relationship Intelligence assertions.

4. Download the public certificate

Download the public certificate only.

Section B — EIE tenant administrator

EIE TENANT ADMIN

5. Confirm the Salesforce connection

EIE → Connected Systems → Salesforce

• The correct organization name is shown.
• The Salesforce Org ID matches the subscriber org.
• Status shows Connected.

6. Register the Salesforce public signing certificate

Inbound Package Authentication → Register Signing Certificate

Accepted formats:

• .crt
• .cer
• .pem
• Pasted PEM text

Confirm the certificate status becomes Active.

7. Copy the Certificate KID

The KID is the certificate fingerprint that identifies the registered public certificate used to verify Salesforce assertions. Copy the full value.

Section C — Salesforce administrator

SALESFORCE ADMIN

Full instructions: Named & External Credentials

8. Populate the Signing Certificate KID

Open the Relationship Intelligence Configuration record, click Edit, and paste the exact KID generated by EIE into Signing Certificate KID.

ribot__Signing_Certificate_KID__c

9. Create or confirm the External Credential

Label: EIE Relationship Intelligence Auth
Name:  EIE_Relationship_Intelligence_Auth
Authentication Protocol: Custom

10. Create the Named Principal

Under Principals on that External Credential, click New and create:

Parameter Name:  EIE_RI_Principal
Identity Type:   Named Principal
Sequence Number: 1

No username, password, OAuth token, or shared API secret is required.

11. Create or confirm the Named Credential

Label:    EIE Relationship Intelligence
Name:     EIE_Relationship_Intelligence
Base URL: https://eie-api.realintelligence.com

12. Confirm the Named Credential settings

The Named Credential provides the Salesforce callout boundary. Authentication to EIE is performed by the RS256 assertion generated by Real Bots.

13. Enable External Credential Principal Access

Open the Relationship Intelligence permission set → External Credential Principal Access → Edit, and enable:

EIE Relationship Intelligence Auth - EIE_RI_Principal

14. Assign the permission set

Assign the Relationship Intelligence permission set to the administrator or user who will run verification. System Administrator rights alone do not grant principal access.

Section D — Google Cloud administrator

GOOGLE CLOUD ADMIN

Full instructions: Google Cloud Service Account Setup

1. Create or select the customer-controlled Google Cloud project.
2. Enable the Admin SDK API.
3. Enable the Gmail API.
4. Create the tenant-specific Relationship Intelligence service account.
5. Enable Google Workspace Domain-Wide Delegation.
6. Record the numeric OAuth Client ID.
7. Create the JSON service-account credential.
8. Upload the credential directly into the correct EIE tenant.

Section E — Google Workspace administrator

GOOGLE WORKSPACE ADMIN

Full instructions: Google Workspace Configuration

1. Open Google Admin Console Domain-Wide Delegation.
2. Add the service account's numeric OAuth Client ID.
3. Authorize the three documented read-only scopes:

https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.domain.readonly
https://www.googleapis.com/auth/gmail.metadata

1. Confirm the Workspace Admin Subject.
2. Confirm the Test Mailbox.
3. Run the EIE Google Workspace verification.

Section F — Salesforce administrator

SALESFORCE ADMIN

1. Run Verify Google Connection from Salesforce.
2. Confirm every verification check succeeds.
3. Record the completion date and responsible administrators.

Last updated 1 month ago