Salesforce Security Guide

Salesforce Security Guide
Salesforce Security Basics
Authenticate Users
The Elements of User Authentication
Configure User Authentication
Restrict Where and When Users Can Log In to Salesforce
Set Password Policies
Expire Passwords for All Users
Modify Session Security Settings
Create a Login Flow
Connect a Login Flow to Profiles
Set Up Two-Factor Authentication
Login Flow Examples
Deploy Third-Party SMS-Based Two-Factor Authentication
Give Users Access to Data
Share Objects and Fields
Strengthen Your Data's Security with Shield Platform Encryption
Monitoring Your Organization’s Security
Security Guidelines for Apex and Visualforce Development
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Create a Login Flow

Use the Cloud Flow Designer to build a login flow. You use a login flow to direct users to perform a business process before they access Salesforce.
Available in: both Salesforce Classic and Lightning Experience
Available in: Enterprise, Performance, Unlimited, and Developer Editions

User Permissions Needed
To open, edit, or create a flow in the Cloud Flow Designer: Manage Force.com Flow

For example, you can insert a form to gather more information from users when they log in. You can direct them to pages for other information, like terms of services. A common use for a login flow is to implement a custom two-factor authentication (2FA) process for increased security.

You create login flow screens with the Cloud Flow Designer. Then you embed the screens in the standard Salesforce login page from Setup. During the authentication process, the user is directed to the login flow screens. When users successfully authenticate and complete the login flow, they’re redirected to Salesforce. The login process can also log out users immediately if necessary.

When you create a login flow for 2FA, you use Apex methods to get the session context, extract the user’s IP address, and verify that the request is coming from a trusted IP range. If the request is coming from within a trusted IP range address, Salesforce skips the flow and logs the user in to the org. If the request is outside the IP range, Salesforce invokes the flow to:
  • Direct the user to log in with additional credentials, such as a time-based one-time password (TOTP)
  • Force the user to log out
  • Direct the user to a page with more options

Build Your Own Login Flow

Use the following process to build your own login flow.

  1. Create a flow using the Cloud Flow Designer and Apex.
    For example, you can design a custom IP-based 2FA flow that requires a second factor of authentication only if the user is logging in from outside of the trusted IP range.

    To find or set the trusted IP range, from Setup, enter Network Access in the Quick Find box, then select Network Access.

    Note

    Don’t set login IP ranges directly in a user profile. If you set the IP ranges in a profile, it restricts access for all users of that profile when they’re outside the range. Then none of these users can enter the login flow process.

    Note

    Include the following in a flow.

    1. A new Apex class for defining an Apex plug-in. The plug-in implements from Process.Plugin and uses the Auth.SessionManagement class to access the time-based one-time password (TOTP) methods and services. The Apex class for the plug-in generates a time-based key with a quick response (QR) code to validate the TOTP provided by the user against the TOTP generated by Salesforce.
    2. A screen element to scan a QR code.
    3. A decision element to handle when the token is valid and invalid.
    Example Custom Two-Factor Authentication Login Flow

    Use these input variables to populate the flow at startup.

    Name Value Description
    LoginFlow_LoginType Type of login, such as Application, OAuth, or SAML
    LoginFlow_IpAddress User’s current IP address
    LoginFlow_LoginIpAddress User’s IP address used during login, which can change after authentication
    LoginFlow_UserAgent User agent string provided by the user’s browser
    LoginFlow_Platform User’s operating system
    LoginFlow_Application Application used to request authentication
    LoginFlow_Community Current community if this login flow applies to a community
    LoginFlow_SessionLevel Current session security level, which can be STANDARD or HIGH_ASSURANCE
    LoginFlow_UserId User’s 18-character ID
    Use these variables to specify where the user goes after completing the flow.

    You must add a UI screen to the login flow to load these values. The login flow loads these values only after a UI screen is refreshed. A user clicking a button doesn’t load the values.

    Note

    Name Description
    LoginFlow_FinishLocation String. Specify where in the org the user goes after completing the login flow. The string must be a relative path or a valid Salesforce URL. The login process can’t redirect the user outside the org.
    LoginFlow_ForceLogout Boolean. Set this variable to true to log the user out immediately and force the user to exit the login flow.
  2. Save the flow.
  3. Activate the flow.
  4. From the Login Flows Setup page, designate the flow as a login flow and connect it to profiles.