Connected App - adding second Salesforce organization

[sumeet]

Hi,

I have used other vendors to backup salesforce and the behavior is that for every salesforce organization that is to be backed-up, a connected app has to be created in that salesforce org and that has to be configured in the backup solution to run the backup policy.

I'm using Veeam backup for salesforce for the first time. The initial configuration, along with separate installation of Postgres SQL along with database creation done separately and then used within Veeam worked fine. The initial configuration wizard completed fine with adding the salesforce connected app. The backup too ran fine, backing up close to 900 GB of data.

Now, my client also has a second salesforce organization. I want to use this same setup. As I check the Adding Organization page in the UI, I see the only option of Log in with Salesforce account. Documentation link - https://helpcenter.veeam.com/docs/backu ... tml?ver=20
According to Veeam documentation, when I will click on login link, I will be redirected to salesforce authentication webpage, and then I need to enter credentials of a salesforce user of the second salesforce organization that I want to add.
Is this correct? Don't I need to provide the connected app details, along with tokens for the second organization?
Is it just sufficient to use the salesforce user from the second organization to login and then I can backup that organization?

This is confusing to me, because as mentioned above, I was thinking that for each Organization to be protected, a connected app is required.

Can someone please check?

Thanks,
-Sumeet.

[MIvanov]

Hello @sumeet , yes, this is correct.

Connected App is describing the application that will be connecting, defining the scope of requested permissions, and other details. By itself, it has no other meaning.
When you use the connected app to connect to ANY org, the user needs to accept (or reject) this app with all the required permissions.

That means, you can create an app in any org, it does not really matter, it just has to exist, and connect to any Salesforce using this app as long as the user authorizes this connection and you receive the session tokens.

From the end-user org, you can create a workflow to limit connections for approved Connected Apps only, however, many don't have any restrictions and allow any app.

[sumeet]

Hi @MIvanov,

Thank you for confirmation.
Does this mean that for my new clients, I can create a connected app in my own Salesforce tenancy and use that for initial configuration and then only get my clients to add their salesforce organization using the Salesforce user login option? But this will create a backup policy and use initial the postgres sql database for my salesforce tenancy.
Maybe it is best to ask clients to create a connected app?

What is the best practice for this?

Also, what happens if clients salesforce Org have restrictions and do not allow any apps - what you say in your last sentence above? In this case, we create a connected app? If yes, then I cannot use an existing VBSF setup as there is no option to configure a second connected app.

Thanks,
-Sumeet.

[anastasia.belyaeva]

Hello, @sumeet

Best practice would be to set up Connected App on your own Salesforce Org, this way you have full control over it.
As currently it's not possible to setup Connected App per each client, configuring Connected app on the client side would make sence if you have separate VBSF installations for each client.

"what happens if clients salesforce Org have restrictions" >> your installation won't not be able to connect to Salesforce if it's not in the list of allowed apps. So it's better to create connected App on own Org and change tokens in product; see details here: https://helpcenter.veeam.com/docs/backu ... tml?ver=20

With one VBSF installation you can backup multiple Organizations, separate DB schema is created for each Org. New Org can be added from Configuration page; see details: https://helpcenter.veeam.com/docs/backu ... tml?ver=20

Also, please read about managing Companies and Users, it might be usefull if you have one installation for several clients.

[sumeet]

Hello Anastasia,

We always have a dedicated VBSF installation for each client. So from your reply, in this case, it is best to use connected app from our clients Org. Correct?

In the current scenario, our same client has two Salesforce Org, which they want to backup. We have created a dedicated VBSF installation for this client and already have one of their Salesforce Org in backup. While adding their second salesforce Org, I hope they do not have any restrictions, because if they do, from what you have mentioned below, we will have to deploy another VBSF installation (which implies another RHEL license, end-point protection license, etc) as we need connected app setup on this Salesforce Org. And with current product funtionality, that only one connected app can be setup, this limits us in such scenarios.

Thanks,
-Sumeet.

[anastasia.belyaeva]

Hello, @sumeet

"it is best to use connected app from our clients Org. Correct?" >> On contrary , better to use connected app created on your own Salesforce org, assuming that you have one. Each installation should be listed in the "Callback URL" of connected app; 1 connected app can support up to 5 installations.

In your current use case:
2nd Org belongs to the same client, so and you can backup both Orgs with one VBSF installation. you don't need another connected app for that.

[MIvanov]

@sumeet If you have one product installation per client (and multiple SF orgs inside this installation) you should create a Connected App per installation.

You can have multiple SF orgs inside this installation, no limit on the number of connections within one installation. It would be more convenient to create this Connected App in your Salesforce so you could manage this app without dependency on the client.

Also, if you enable Salesforce SSO, make sure that customer is not using integration user to log into the installation. This will revoke previously issued tokens after several logins.

[maruv]

I have used Veeam backup for salesforce for multiple organizations and it works fine. You don’t need to create a separate connected app for each organization. You can use the same connected app that you created during the initial configuration. The connected app is just an identity that allows Veeam to access the Salesforce API. You still need to authorize the connected app for each organization that you want to backup. This is done by logging in with a Salesforce user account of that organization. Once you do that, Veeam will save the OAuth tokens of the connected app for that organization and you can run backup policies for it.