"Test Connection" fails with Invalid Credentials message when attempting to configure using Salesforce Connector wizard in RSA UI; but am able to access Slaesforce instance from personal desktop browser using credentials and password. I have verified with our network team that Firewall access is allowed for https connections. I have also verified that RSA webservices has been enabled. Any other suggestions or ideas to troubleshoot this connectivity problem?
Thank you for your response. I did login to the application directly using the UserID and Password without any problems. However in the RSAIMG UI and after making the suggested changes I still encountered “Invalid Credentials” message. A debug trace of the error message found the following additional information “Collector test failed: Request failed with response: Invalid Credentials. Error occurred while connecting Salesforce instance. PKIX path building failed: unable to find valid certification path to requested target.”
Larry Carter, Information Security Architect, Enterprise Security
office: 919.765.3157 | mobile: 706.587.4350 | larry.carter@bcbsnc.com<mailto:joe.sinsangkeo@bcbsnc.com>
Thanks for the question, Larry (and thanks for the reply, Teeka).
I'd encourage you to post this conversation on the IMG product community here RSA Identity Governance & Lifecycle Client/Partner Community - that's a better place for this kind of product-specific technical question.
Thank you for your response Patrice, however, the changes as suggested by you and the documentation do not work. Additionally, under RSA Via 7.0.0 you are required to have a "Security Token". In our instance and based on the wording in the RSA documentation it says "Security token for the user created for integration. A security token is an automatically generated key in order to login to Salesforce from an "untrusted" network. If network is trusted to Salesforce this token is not required. To generate this token explicitly, login to Salesforce using the integration user account and then goto "Setup" select "My Personal Information" => "Reset My Security Token" option." Additionally, if you use the wizard to define the collector, the "Security Token" is also a mandatory field. Our instances of Salesforce sees all of my networks as "trusted" and therefore a "Security Token" is never generated. So, whether we are using 6.9.1 or RSA Via 7.0.0 we still are unable to establish a connection between any of our RSA environments and our Salesforce instances and the documentation is no help.
Two things:
In my experience,
1. the Salesforce Admin MUST go into salesforce and generate a security token
2. Be adamant about having the customer ensure there is no proxy server. In my case the customer swore there was none. After months of troubleshooting it was discovered they did in fact have one.
As you are seeing the certificate error, this is happening because of the handshaking failure from the collector and the salesforce endpoint (you are using https). So, you need to get the cacert of the salesforce and add it to the IMG server trust store (copy to the JVM/cacert location). Restart the IMG server and test it out.
I'm currently in the process of on-boarding Salesforce application to RSA IMG v6.9.1 P07
I've used the Salesforce wizard to create application, collectors and connectors.
I might have experienced similar issue to what you are describing, but it was resolved after configuring the correct credentials (including security token).
I suggest you try testing the connection not via the GUI, but rather using command line and curl.
Here is an example:
curl https://qweasdzxc.salesforce.com/services/Soap/c/28.0/ -H "Content-Type: text/xml; charset=UTF-8" -H "SOAPAction: login" -d @login.txt
Note: you should modify the instance URL to what was provided to you by your customer.
The output of it, will be a SOAP response with a lot of information (in case of a success) or short SOAP response with failure message.
The login.txt file contains the following SOAP request:
<?xml version="1.0" encoding="utf-8"?> <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:enterprise.soap.sforce.com"> <soapenv:Body> <urn:login> <urn:username>user@domain.com</urn:username> <urn:password>Password+SecurityToken</urn:password> </urn:login> </soapenv:Body> </soapenv:Envelope>
Note that the password filed value is a concatenation of password value and security token value.
Regards
Boris
I have seen this before.
In my case it was a misconfiguration by following the misleading documentation.
Where it says to look for soap address in the WSDL file and enter that into the instance URL
Enter the Salesforce Instance URL specified in WSDL under the node "soap:address"
THIS IS NOT ENTIRELY CORRECT. YOU CANNOT ADD THE STRING OF CHARACTERS OR THE VERSION AFTER THE /C in the string.
Example:
<soap:address location="https://login.salesforce.com/services/Soap/c/31.0/0DF3125000008YtL"/>
REMOVE everything past /Soap/c/
Like this: <soap:address location="https://login.salesforce.com/services/Soap/c/
Enter target namespace specified in WSDL under node "definitions" attribute "targetNamespace"
Target namespace is specified by the contract the customer has with SalesForce. It is either Enterprise or Partner
Salesforce API URL
Base URL of the Salesforce API Access. For example, https://ap1.salesforce.com
When the user logs into SalesForce this is the address that it RESOLVES to
Username
Username for the user created for integration:
This user must have the permissions in SalesForce as outlined by the documentation
Password
Password for the user created for integration
Security Token
Security token for the user created for integration. A security token is an automatically generated key in order to log in to Salesforce from an untrusted network. If network is trusted to Salesforce need not to provide this token. To generate this token explicitly, login to Salesforce using this user and then goto "Setup" page and select "My Personal Information" -> "Reset My Security Token" option.
Salesforce API Version
Provide Salesforce API version supported by Salesforce instance
attached is a doc I wrote awhile back that might help