Salesforce Connect

Salesforce connect is a framework that enables you to view, search and modify data that's stored outside your Salesforce org. Instead of extracting and copying that data into your org using ETL tool, we can use external objects to access that data real time using web-service callouts.

Salesforce recommend to use Salesforce Connect if

1. You have large amount of data that you don't want to copy into your Salesforce org.
2. You need small amount of data at any one time.
3. You need real-time access to the latest data.
4. You store your data in the cloud or in a back-office system, but want to display or process that data in your Salesforce org.

External Objects:

External objects in Salesforce are similar as custom objects but they are mapped to data located outside your Salesforce org. Each of the external object’s fields maps to a table column on the external system. External objects enable users to search and interact with the external data.

Each org can have up to 100 external objects and external objects do not count towards the amount for custom objects.

With external objects we can

• Access external objects via list views, detail pages, record feeds, custom tabs, and page layouts.
• Enable chatter feeds on external objects pages for collaboration.
• Enable create, edit, and delete operations on external objects.
• Define relationships between external objects and standard or custom objects to integrate data from different sources.

External objects are also available to standard Salesforce tools such as Salesforce app, global search, SOSL, SOQL queries, Apex, Visualforce, APIs, change sets and packages.

Following features is not allowed with External objects

1. Formula fields is not allowed, you cannot create formula field on External object.
2. You cannot create workflow rules on External objects
3. You cannot write triggers on External objects.
4. You cannot write sharing rules on External objects.

Type of External Connectors:

1. OData 2.0 adaptor or OData 4.0 adaptor - Connects to data exposed by any OData 2.0 or 4.0 producer on the Internet. OData (Open Data Protocol) is a modern, REST-based protocol for integrating data.
2. Cross-org adaptor - Connects to data that’s stored in another Salesforce org. The Cross-org adapter uses the standard Lightning Platform REST API.
3. Custom adaptor created via Apex - If the OData and cross-org adapters aren’t suitable for your needs, develop your own adapter with the Apex Connector Framework.

Set up Salesforce Connect:

1. Install Salesforce Lightning Connect package from this link.
2. Click Install to start the installation.
3. Once installation complete, select External Orders app.
4. Under QuickStart tab, click Set Customer IDs to assign customer ID numbers to the account records in org.
   This step will populate CustomerIDs to Account records in Salesforce org.
5. Go to setup, search and open External Data Sources.
6. Click on 'New External Data Source'.
7. Enter label as OrderDB and select Salesforce Connect: OData 2.0 as the type.
8. In URL enter https://orderdb.herokuapp.com/orders.svc/.  
   
   If you are connect with external system that requires authentication than you can configure that under Authentication section but in our case we don't need it.
   
   
9. Click Save.
10. Click on Validate and Sync, it retrieve OData 2.0 metadata from database and lists the available tables.

11. Click on Sync.
    Syncing creates the external objects corresponding to the tables that you selected. Syncing does not store any data in Salesforce. Syncing only defines mappings to external tables or repositories that contain the data.
    
    You can choose to manually create the external objects. Doing so enables you to customize the external object names, decide which table columns to create custom fields for, and customize the custom field names.

You can create custom tabs to access Order and Order Details records.

Order record in Salesforce will look like: 

Once External objects created in Salesforce Org, click on OrderDetails external object

1. Click Edit next to orderID field.





2. Click on Change Field Type.
3. Now select External Lookup Relationship and click Next.





4. Select Orders as related object and click Next.





5. Enter length as 18 and click Next.
6. Select visible to all profile and Save.
7. Now from select Order object and under Fields and Relationships click Edit next to CustomerID.
8. Click the Change Field Type button.
9. Select Indirect Lookup RelationShip and click Next.
10. Select Account as related object and click Next.
11. Select Customer_ID__c as the value of Target Field and click Next.
12. Enter length size as 18 and click Next.
13. Make relationship visible to all profile and save the changes. This steps will link the Accounts with Order records which which was populated at the starting. From Order record when we click on CustomerID link it will take us to Account detail page.

Difference between External Objects and Custom objects are:

• External object API names have the suffix __x rather than __c
• External objects have a reference to their external data source and a table within that source.
• External objects have different standard fields. Display URL is the OData 2.0 URL representing a record in the external database, while External ID is the primary key value for each record.
• You cannot write triggers and workflow rules for external objects.
• You cannot create formula field on external objects.

Relationship Types:

There are three types of external relationships

Type of Relationship	Child Object	Parent Object	Must External Data Contain Salesforce IDs?
Lookup	Standard, Custom, or External	Standard or Custom	Yes
External Lookup	Standard, Custom, or External	External	No
Indirect Lookup	External	Standard or Custom	No

References : Salesforce Trailhead, Salesforce Help

SOQL Injection

A SOQL injection consists of insertion or injection of SOQL query via the input data from client to application. A successful SQQL injection exploit can read sensitive data from the database.

Below is the example of Apex and Lightning Component code vulnerable to SOQL injection.





Now enter name existing contact name and click on search button to see the result, in my case I search for contact whose Name contains 'Winter'.

Now in search box enter " winter%' OR Name LIKE ' " and click on search button to all contact records.

How to prevent SOQL injection?

1. Static Query: To prevent SOQL injection attach, avoid using dynamic SOQL queries. Instead, use static queries and binding variables.

2. Escaping Single Quotes: use of string.escapeSingleQuotes() method arounf variable function escapes any instance that it finds of a ‘ quote in the string using the backslash (\) escape character. This prevents an attacker’s input from being treated as code by constraining them to the boundary of the string.


References: Salesforce Developer Guide, trailhead