The Salesforce mandate
Salesforce requires ISV partners to enable four OAuth security controls on every Connected App and ECA:- Proof Key for Code Exchange (PKCE)
- Refresh Token Rotation (RTR)
- An idle refresh token TTL of 30 days
- A refresh token IP range allowlist
Proof Key for Code Exchange
PKCE protects the OAuth authorization code flow against interception attacks on the authorization code, particularly for public clients, such as mobile apps. Partners must enable PKCE in the OAuth settings of their Salesforce Connected Apps and ECAs, regardless of whether the client is public or confidential.Refresh Token Rotation
RTR improves security by invalidating the old refresh token and replacing it with a new one every time a new access token is issued. If a refresh token is stolen, it’s invalidated the next time the refresh token flow runs, which limits an attacker’s window of opportunity. RTR is a critical defense against long-term session hijacking.Idle refresh token TTL of 30 days
A refresh token’s time-to-live (TTL) defines the maximum time it remains valid. A shorter TTL is a critical security measure that reduces an attacker’s window of opportunity if a refresh token is compromised. By limiting the duration of a potential compromise, this control prevents unauthorized users from maintaining indefinite access to a system, mitigating the risk of long-term persistence.Refresh token IP range allowlist
This control adds another layer of security by ensuring that refresh token requests can only originate from a predefined set of IP ranges owned by the client. Salesforce immediately rejects refresh token requests from unrecognized IP addresses, which blocks threat actors from using compromised tokens.What this means for Maia Foundation
As a result of the Salesforce mandate, Matillion has made a number of changes to comply with these updated security requirements. We’ve worked to minimize the impact of these changes on your day-to-day operations. Moving to a token rotation model requires changes to our product, so you need to upgrade to a minimum version that supports the new authorization model. Once you’ve upgraded, your pipelines continue to operate as they do now. Any Salesforce tokens used within your installation are rotated automatically as your pipelines run.Read version tracks for more information about upgrading your runner.
Potential impact of the 30-day idle token timeout
Salesforce automatically invalidates refresh tokens that haven’t been used for 30 consecutive days. Previously, refresh tokens were often configured as valid until revoked, meaning a token stored months or years ago could still be used to obtain fresh access tokens indefinitely. Active pipelines that refresh their tokens regularly reset the 30-day idle clock on every use, so most customers aren’t affected. The only affected scenario is a token that’s been idle for more than 30 days. For example, if a pipeline runs less often than once every 30 days and uses a dedicated Salesforce OAuth token that isn’t shared or refreshed elsewhere, you need to re-authorize the connection before the pipeline can run successfully.What you need to do
- Upgrade to version
11.494.0-patch.4or later so that your installation supports the new Salesforce OAuth authorization model. - If you have Salesforce pipelines that run less often than once every 30 days using a dedicated OAuth token, be prepared to re-authorize the connection.