Overview
Salesforce have launched App Insights in administrator setup. This new dashboard gives Customers direct visibility into the CA/ECA Requirements adoption status of both their locally developed custom apps as well as packaged and installed third-party apps operating within their Org.
Customers can log into your administrator console and navigate to App Insights to review the security status for all connected apps and external client apps.
Payments2Us Connected App Statuses
Payments2Us includes two Connected Apps as part of its managed package:
- Payments2Us
- Payments2Us Sandbox
Both Connected Apps comply with Salesforce's recommended OAuth security controls. The following three OAuth security controls are already enabled and locked for both apps:
- Refresh Token Rotation
- Proof Key for Code Exchange (PKCE)
- Refresh Token Idle Timeout
The remaining security control under the Proof of Possession Control category, Refresh Token IP Allowlist, is not applicable to either of our Connected Apps. Both apps are exempt from this requirement.
As a result, the Salesforce Connected Apps Insights tab may indicate that this control is not enabled, making it appear as though our Connected Apps are non-compliant. However, this is expected because the control is not applicable to our specific use case.
Salesforce Support Confirmation
Salesforce Support has officially confirmed that both Payments2Us Connected Apps meet the applicable recommended OAuth security requirements, and that the Refresh Token IP Allowlist control is not applicable to them.
The following is Salesforce's confirmation for reference:
