Use More OAuth Features with External Client Apps
The external client apps framework, a new and improved generation of connected apps, is catching up to connected apps fast. The new framework now supports headless login, passwordless login, and guest user flows using the Authorization Code and Credentials Flow. You can also configure an external client app to issue JSON Web Token (JWT)-based access tokens.
Where: The changes to support the Authorization Code and Credentials Flow apply to LWR, Aura, and Visualforce sites accessed through Lightning Experience and Salesforce Classic in Enterprise, Unlimited, and Developer editions. The changes to support JWT-based access tokens apply to Lightning Experience and Salesforce Classic in Group, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer editions.
Why: Unlike the connected apps framework, the external client apps framework is compatible with second-generation packaging (2GP), making apps easier to package and distribute. It’s also more secure and fully metadata-exposed. And its design makes it easy to define clear roles for developers and admins.
How: Create and edit external client apps via the External Client App Manager in Setup, or use Metadata API. External client apps currently support all variations of the Authorization Code and Credentials Flow except headless registration.
Create External Client Apps While Maintaining Security and Defined User Roles
Try the new External Client App Manager to create, manage, and update your external client apps. You can still do all these things with Metadata API, but this new user interface means that now you don’t have to. With External Client App Manager,you can create a local app just for your org or design one to package and distribute.
Where: This change applies to Lightning Experience in Professional, Performance, and Unlimited editions.
Who: The External Client App Manager is shown only to Lightning Experience-enabled users on orgs that have opted in to External Client Apps.
Why: As part of the new generation of Connected Apps, External Client Apps offers the ability to connect external applications with Salesforce data while maintaining security and clearly defining user roles. External client apps are designed with the security of second-generation managed packaging in mind.
https://help.salesforce.com/s/articleView?id=release-notes.rn_security_eca.htm&release=250&type=5
Brand the Welcome Email for Passwordless Registration
Take control of identity experiences for customers and partners. Use the new Welcome New Member for Passwordless Registration email template to customize the one-time password (OTP) email that users receive when they sign up for your Experience Cloud site using passwordless registration.
Where: These changes apply to LWR, Aura, and Visualforce sites accessed through Lightning Experience and Salesforce Classic in Professional, Enterprise, Unlimited, and Developer editions.
Customize SMS One-Time Password Delivery for Experience Cloud Sites (Beta)
To provide branded, personalized identity verification experiences for external users, create an Apex handler to send one-time passwords (OTPs) via an SMS messaging provider of your choice. Customize the content of the message and the short code that tells users who sent it. Use the handler to send OTPs for any Experience Cloud identity verification use case, such as multi-factor authentication (MFA) and passwordless login.
Where: These changes apply to LWR, Aura, and Visualforce sites accessed through Lightning Experience and Salesforce Classic in Enterprise, Unlimited, and Developer editions.
Why: For Experience Cloud sites, use a custom OTP provider for any identity verification use case that uses SMS, such as MFA, passwordless login and registration, self-registration with SMS, and device activation.
For headless apps, use a custom OTP provider to send SMS messages during the headless forgot password, passwordless login, and registration flows.
How: Create a custom one-time password delivery handler Apex class. From your Experience Cloud Login & Registration settings, in the Customized OTP Delivery section, select your Apex handler class.
To opt in to this feature, contact your Salesforce account executive. Opting in to this feature affects all Experience Cloud sites. To avoid disruptions, enable the Apex handler for all sites.
Identity and Access Management
Use the External Client App Manager in Setup to create and manage external client apps, and check out the new flows for external client apps. Also in Setup, define and enable OAuth 2.0 token exchange handlers for the OAuth 2.0 token exchange flow. Create uninterrupted user experiences across Salesforce and custom interfaces with the new Single-Access UI Bridge API.
- Customize SMS One-Time Password Delivery for Experience Cloud Sites (Beta)
To provide branded, personalized identity verification experiences for external users, create an Apex handler to send one-time passwords (OTPs) via an SMS messaging provider of your choice. Customize the content of the message and the short code that tells users who sent it. Use the handler to send OTPs for any Experience Cloud identity verification use case, such as multi-factor authentication (MFA) and passwordless login. - Brand the Welcome Email for Passwordless Registration
Take control of identity experiences for customers and partners. Use the new Welcome New Member for Passwordless Registration email template to customize the one-time password (OTP) email that users receive when they sign up for your Experience Cloud site using passwordless registration. - Create External Client Apps While Maintaining Security and Defined User Roles
Try the new External Client App Manager to create, manage, and update your external client apps. You can still do all these things with Metadata API, but this new user interface means that now you don’t have to. With External Client App Manager,you can create a local app just for your org or design one to package and distribute. - Use More OAuth Features with External Client Apps
The external client apps framework, a new and improved generation of connected apps, is catching up to connected apps fast. The new framework now supports headless login, passwordless login, and guest user flows using the Authorization Code and Credentials Flow. You can also configure an external client app to issue JSON Web Token (JWT)-based access tokens. - Integrate Custom App Experiences with the Salesforce UI
Give users uninterrupted access across custom apps and Salesforce. With the new Single-Access UI Bridge API, use an existing Salesforce access token to load a new session in a Salesforce UI, such as a Visualforce site or mobile app. For example, when users are logged in to a headless app, redirect them to your Experience Cloud site to view Support cases without making them log in again. - Create Token Exchange Handlers More Easily
For better usability when configuring the OAuth 2.0 token exchange flow, define and enable OAuth 2.0 token exchange handlers in Setup instead of using Metadata API. Create a handler definition, link it to an Apex class, and set some of its properties, such as what types of tokens it supports and whether it can create users. - Migrate to a Multiple-Configuration SAML Framework (Release Update)
If you see this release update, your Salesforce instance is using our original single-configuration SAML framework, which supports single sign-on (SSO) with only one external identity provider. With this release update, we’re removing support for the single-configuration SAML framework and supporting only the multiple-configuration SAML framework. To preserve your existing configuration, follow the steps to apply this update. If you don’t, your SSO configuration stops working when this update is enforced. This update was first made available in Spring ’24. It was scheduled to be enforced for all instances in Summer ’24, but we postponed the enforcement date for production instances to Spring ’25. This update is still enforced for sandboxes in Summer ’24. - Enter New Firebase Information Required for Android Push Notifications
The legacy Firebase Cloud Messaging API server key is no longer accepted for configuring Android push notifications on mobile connected apps. Because of a change in how Google handles push notifications, Android mobile connected apps now require the Admin SDK private key and project ID from a Google Firebase project. - Use REST API for Access to External Client App OAuth Consumer Credentials (Release Update)
To follow recommended security standards, use the newcredentialsConnect REST API resource instead of Metadata API to access External Client App OAuth consumer credentials. - Verify Email Addresses to Meet the Email Verification Requirement
To complete enforcement of the email verification requirement introduced in the Spring ’22 major release, Salesforce now requires all users in all orgs and Experience Cloud sites to verify their email address. If a user sends an email from an unverified email address, Salesforce rejects this email message and doesn’t complete the send. Unverified email addresses can’t be used for sends until the user verifies their email address or resets their password. To avoid disruptions, ensure that all user email addresses are verified. - Stay on Top of MFA Compliance
Multi-factor authentication (MFA) is turned on by default for direct logins to production orgs as of April 8, 2024. Starting in Summer ’24, admins get in-app reminders if they don’t comply with the MFA requirement. - Forced Login is Permanently Disabled in Winter ’25
To improve security, in Winter ’25, users can no longer log in to Salesforce by passing a username and password as URL query string parameters in the login URL, also known as forced login. This change will break implementations and third-party integrations that use a forced login via a URL, as well as direct login (autologin) links. To avoid service disruptions, update integrations that use forced login. - Identify the Origin IP Address for Logins with One or More Proxies
To monitor login activity more thoroughly and prevent potential threats, you can now see what value the client passed in theX-Forwarded-Forheader of their HTTP request to Salesforce. For logins that redirect users to one or more proxies, theX-Forwarded-Forfield is sometimes used to store the origin IP address of the client. Use the new Forwarded for IP column in the Login History and related fields to track the origin IP address. This change isn’t available for OAuth and single sign-on (SSO) logins. - Password Reset Login Subtype Label Is Changed
For more consistency with naming conventions, we renamed the label for the password reset login subtype in the Login History. When a user resets their password, the Login Subtype column now displays UI Password Reset instead of Change Password. - Enable Embedded Login
Although Salesforce doesn’t recommend it, if you must use Embedded Login with your Experience Cloud Site, you can enable it on the Login & Registration page. In Summer ’24, Salesforce disabled Embedded Login by default to encourage users to move to OAuth 2.0 Web Server Flow or OAuth 2.0 User-Agent Flow. - Take Advantage of Apex Enhancements for Processing JSON Web Tokens (JWTs)
With changes to how JSON Web Tokens (JWTs) are processed, it’s now easier to extract data from JWTs generated by methods in theAuth.JWTUtilclass. We also clarified what methods we support for a JWT depending on where it came from. And you can get more test coverage by mocking HTTP callouts when processing JWTs. - Use the Token Exchange Flow with More Identity Providers
With new support for larger tokens, use the OAuth 2.0 token exchange flow with a wider range of third-party identity providers. When you send third-party tokens to Salesforce in thesubject_tokenparameter, the value can be up to 10,000 characters long. Previously, the maximum length for values in this parameter was 2,000 characters. - Simultaneous Token Requests Are Blocked During the Refresh Token Flow
To reduce performance issues, we now prevent client apps from sending simultaneous token requests with the same refresh token when using the OAuth 2.0 refresh token flow. Previously, identical token requests sent at the same time didn’t fail, but they did lead to system issues across Salesforce. To avoid disruptions, update integrations that use the refresh token flow to stop sending simultaneous, identical requests to the token endpoint. Improve the efficiency of your integrations by reusing access tokens instead of continually requesting new ones.
Maximize Availability with Partitioned Domains in More Orgs
To maximize the availability of your orgs, My Domain uses partitioned domains for new Developer Edition orgs, patch orgs, scratch orgs, demo orgs, and Trailhead Playgrounds. Partitioned domains include a word related to the org type so that Salesforce can gradually roll out service-delivery changes. This feature is enabled by default in new qualifying orgs, and sandboxes with enhanced domains are always partitioned. To ensure continued access to all your orgs, update your allowlists for the new domains. To include your existing org in the Salesforce deployment schedule for that org type, enable and deploy partitioned domains.
Where: This change applies to non-production orgs with enhanced domains in Lightning Experience, Salesforce Classic, and all versions of the Salesforce mobile app in Group, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer editions. The scratch partition is newly available if you use Salesforce Edge Network. Only the sandbox partition is available in Government Cloud—Defense orgs. Partitioned domains aren’t available in Trailhead Playgrounds on Salesforce Edge Network.
How: To ensure that your users can connect to partitioned domains, update your allowlists.
In existing demo orgs, Developer Edition orgs, patch orgs, scratch orgs, and Trailhead Playgrounds with enhanced domains, you can enable or disable this feature from the My Domain Setup page. When you enable the Use partitioned domains option in the My Domain Details section, you can preview your new My Domain login URL at the bottom of the screen. To use partitioned domains, save the change and deploy your new My Domain.
Grant Specific Permission to Manage Custom Domains
Permit users to add, edit, and delete custom domains and custom URLs without granting them broader admin privileges. A custom domain serves your Experience Cloud sites or Salesforce Sites on a domain that you own, such as https://www.example.com. Previously, to manage custom domains, you assigned the Customize Application user permission.
Where: This change applies to Lightning Experience and Salesforce Classic in Enterprise, Performance, and Unlimited editions. Custom domains are also available in Professional Edition with Marketing Cloud Account Engagement (Pardot).
How: Add the new Custom Domain Management user permission to a new or existing permission set. Then assign the permission set to the users who require this permission.
Identify Redirections for Your Instanced My Domain Hostnames
Identify your hard-coded instanced My Domain URLs to update before those redirections end in Winter ’25. To help you, a field on the Hostname Redirects event type now tracks redirections for these URLs.
Where: This change applies to Lightning Experience and Salesforce Classic in Enterprise, Performance, Unlimited, and Developer editions. The Hostname Redirects event is available in the API but not in the Event Monitoring Analytics app. This event is free for all customers with a 24-hour data retention period.
Update References to Your Previous Salesforce Domains
Prevent disruption for your customers and end users when the temporary redirection of legacy Salesforce domains ends. To help your users update outdated links and bookmarks, show a brief message during the redirections that provides the updated URL. Then update references to your previous Salesforce URLs, including site URLs and URLs that contain your Salesforce instance but not your My Domain name.
Where: This change applies to Lightning Experience and Salesforce Classic in Group, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer editions.
When: Salesforce stops the redirections for these hostnames in Winter ’25. The deployment of that release is scheduled to start in August 2024 for sandboxes and in September 2024 for production.
Domains
Update references to legacy Salesforce URLs before redirections stop in Winter ’25. Give users access to manage custom domains with a new, more targeted user permission. And scratch orgs on Salesforce Edge Network use partitioned domains.
- Update References to Your Previous Salesforce Domains
Prevent disruption for your customers and end users when the temporary redirection of legacy Salesforce domains ends. To help your users update outdated links and bookmarks, show a brief message during the redirections that provides the updated URL. Then update references to your previous Salesforce URLs, including site URLs and URLs that contain your Salesforce instance but not your My Domain name. - Identify Redirections for Your Instanced My Domain Hostnames
Identify your hard-coded instanced My Domain URLs to update before those redirections end in Winter ’25. To help you, a field on the Hostname Redirects event type now tracks redirections for these URLs. - Grant Specific Permission to Manage Custom Domains
Permit users to add, edit, and delete custom domains and custom URLs without granting them broader admin privileges. A custom domain serves your Experience Cloud sites or Salesforce Sites on a domain that you own, such as https://www.example.com. Previously, to manage custom domains, you assigned the Customize Application user permission. - Maximize Availability with Partitioned Domains in More Orgs
To maximize the availability of your orgs, My Domain uses partitioned domains for new Developer Edition orgs, patch orgs, scratch orgs, demo orgs, and Trailhead Playgrounds. Partitioned domains include a word related to the org type so that Salesforce can gradually roll out service-delivery changes. This feature is enabled by default in new qualifying orgs, and sandboxes with enhanced domains are always partitioned. To ensure continued access to all your orgs, update your allowlists for the new domains. To include your existing org in the Salesforce deployment schedule for that org type, enable and deploy partitioned domains.