Migrating a Salesforce connected app from assword authentication to client credentials flow

The client credentials flow is an OAuth 2.0 authentication method that allows server-to-server integration without requiring a user login session. Migrating your Salesforce connected app from password authentication to client credentials flow improves security and aligns with Salesforce's modern authentication standards.

Overview

Password authentication (Resource Owner Password Credentials) is a legacy OAuth flow that Salesforce is deprecating in favor of more secure alternatives. The client credentials flow eliminates the dependency on individual user credentials for API access and instead uses a dedicated run-as user with a client ID and client secret. This approach reduces the risk of credential exposure and simplifies credential rotation.

Migration requires configuration changes on both the Salesforce side (connected app settings and OAuth policies) and the QRadar side (log source authentication method).

Salesforce connected app configuration

To enable the client credentials flow, you must edit the connected app's OAuth settings in Salesforce Setup.

  1. Log in to the Salesforce user interface at https://login.salesforce.com.
  2. Navigate to Setup > App Manager.
  3. Locate the required connected app and click Edit.
  4. Under API (Enable OAuth Settings), verify that Enable OAuth Settings is selected, and then enable the Client Credentials Flow option.
  5. Click Save.

Run-as user configuration

The run-as user defines which Salesforce user account the client credentials flow uses when making API calls. This setting is available only from the Manage page of the connected app, not from the Edit page.

  1. In Salesforce Setup, search for and open App Manager.
  2. Locate the required connected app, click the dropdown arrow next to the app, and select Manage.
  3. On the Connected App Detail page, click Edit Policies.
  4. In the OAuth Policies section, verify that the Permitted Users value is set to All users may self-authorize.
  5. In the Client Credentials Flow section, select the Salesforce user account in the Run As User field. In some Salesforce UI versions, this field is labeled Execution User.
  6. Click Save.

QRadar log source configuration

After you configure the connected app in Salesforce, update the corresponding log source in QRadar to use the client credentials flow authentication method.

  1. Log in to the QRadar user interface.
  2. Navigate to Admin > Log Sources.
  3. Open the required log source and click Edit.
  4. Set the Authentication Method to Client Credentials Flow.
  5. Verify the Client ID and Client Secret values.
  6. Click Save.