Supported editions

Structural is compatible with the following editions of Salesforce:

• Professional

• Enterprise

• Unlimited

Required and supported products

Structural requires Sales Cloud.

It can also support any Salesforce product that is compatible with Sales Cloud.

Table mode limitations

You can only assign the De-Identify or Truncate table modes.

Generator limitations

Salesforce does not support any of the . These are:

• Alphanumeric String Key

• ASCII Key

• Integer Key

• Numeric String Key

Subsetting limitations

When you configure subsetting for a Salesforce workspace, you cannot filter optional records.

No upsert

Salesforce workspaces do not support upsert.

No post-job scripts

For Salesforce workspaces, there is no option to run post-job scripts after a job.

You can create that are triggered by data generation jobs.

No output to a container repository

For Salesforce workspaces, you cannot write the destination data to a container repository.

Salesforce is a customer relationship management (CRM) tool used to manage sales and service.

During workspace creation, under Connection Type, click Salesforce.

Connecting to the source data

Before you can configure the source connection, you must create the connection in Salesforce. The source connection can be either a production org, a sandbox org, or a scratch org.

Providing the connected application keys

To connect to the Salesforce application, Structural requires a consumer key and a consumer secret. You get these values from the Salesforce connected application that you created in Salesforce.

You can configure these as the values of the TONIC_SALESFORCE_CONSUMER_KEY and TONIC_SALESFORCE_CONSUMER_SECRET.

If these environment settings are not configured, for example in Structural Cloud, then under Source Settings, the Connected App Credentials panel is displayed.

1. In the Consumer Key field, provide the consumer key value.

2. In the Consumer Secret field, provide the consumer secret value.

Providing and testing the server path

Under Source Settings, to connect to the source connection:

1. In the Server field, type the path to the source connection server.

2. Click Authenticate with Salesforce. Structural sends you to Salesforce to authenticate to the source connection. Note that if this is the first time you log in to Salesforce with the user for Structural, you are prompted to confirm the additional permissions that are granted to the connected application.

3. After you authenticate, to test the connection, click Test Source Connection.

Connecting to the destination data

Before you can configure the destination connection, you must create the connection in Salesforce.

The destination connection must be either a sandbox org or a scratch org. However, the destination connection can only be a scratch org if the source connection is also a scratch org.

The destination connection must be a separate org from the source connection.

Providing the connected application keys

To connect to the Salesforce application, Structural requires a consumer key and a consumer secret.

If the TONIC_SALESFORCE_CONSUMER_KEY and TONIC_SALESFORCE_CONSUMER_SECRET are not configured, for example in Structural Cloud, then under Destination Settings, the Connected App Credentials panel is displayed.

To use the same key and secret that you provided under Source Settings, click Copy Settings from Source.

Otherwise:

1. In the Consumer Key field, provide the consumer key value.

2. In the Consumer Secret field, provide the consumer secret value.

Providing and testing the server path

Under Destination Settings, to connect to the destination connection:

1. In the Server field, type the path to the destination connection server.

2. Click Authenticate with Salesforce. Structural sends you to Salesforce to authenticate to the destination connection.

3. After you authenticate, to test the connection, click Test Destination Connection.

De-identifying Salesforce users in the destination data

If Scramble Specific Users’ Data is enabled for the destination org, then you can configure the workspace to de-identify Salesforce users in the destination data.

To de-identify Salesforce users, toggle De-identify Salesforce Users to the on position.

Excluding users from de-identification

Salesforce automatically excludes from de-identification specific internal users and users that have specific roles.

To exclude other users from de-identification, in the Excluded usernames field, type a comma-separated list of the users to exclude.

Salesforce internal users that cannot be de-identified

The following internal users are never de-identified:

• Automated User

• Platform Integration User

• Analytics Cloud Integration User

• Analytics Cloud Security User

Salesforce roles for which users cannot be de-identified

Users who have the following roles cannot be de-identified. If you need to de-identify a user that has one of these roles, then before you run data generation, you must assign a different user to the role.

Configure Salesforce as an Identity Provider

You must enable Salesforce as an Identity Provider.

This is required for authentication between Salesforce and Structural. It is independent of any existing Salesforce single sign-on (SSO) user login.

Enable Grant API Enabled Access

You must

This is required for authentication between Salesforce and Structural.

Creating the connected Salesforce application for Structural

For the integration between Structural and Salesforce:

• Salesforce is set up as an Identity Provider for Structural

• OAuth bearer tokens are used to transparently access Salesforce from Structural.

There are no separate passwords or user secrets. Each user is limited to only the data available based on their available level of access for their Salesforce or Structural account.

Create the application in Salesforce

1. Log into your Salesforce instance.

2. Make sure that Salesforce is enabled as an with .

3. In the top right corner, click the gear icon, then click Setup.

1. On the Setup page, in the search field, enter App Manager, then select App Manager.

1. Click New Connected App.

1. On the Create a Connected App panel, click Create a Connected App.

2. On the New Connected App page, under Basic Information, fill in the following fields:

   • Connected App Name. We recommend that you include 'Tonic' somewhere in the name. Note that after you create a connected app, you cannot change the name.

1. Under API (Enable OAuth Settings):

   1. Check Enable OAuth Settings.

   2. In the Callback URL field, enter the URL of your Structural instance with /oauth2/callback appended to it. For a self-hosted instance, if you do not have access to the Structural URL, contact the Structural administrator at your organization. If your organization has deployed more than one Structural instance, you can enter multiple URLs. For Structural Cloud, the callback URL is https://app.tonic.ai/oath2/callback

1. Navigate to the bottom of the page, then click Save.

Retrieve the consumer key and secret

After you save the new application, to retrieve the consumer key and secret values:

1. Expand the API (Enable OAuth Settings) section, then click Manage Consumer Details.

1. Locate and copy the values of Consumer Key and Consumer Secret. You use these to populate the consumer key and secret values in Structural.

Set the consumer key and secret Structural environment settings

Configure the following , which you can configure from the Environment Settings tab on Structural Settings:

• TONIC_SALESFORCE_CONSUMER_KEY - Set to the consumer key value that you copied from Salesforce.

• TONIC_SALESFORCE_CONSUMER_SECRET - Set to the consumer secret value that you copied from Salesforce.

If you do not configure these environment settings, then you must provide the consumer key and consumer secret in the workspace configuration. For example, on Structural Cloud, you must always configure the consumer key and secret in the workspace.

Confirming the connected application permissions

After you set up the connected application, the first time that you log in to Salesforce with the user that connects from Structural, Salesforce displays a warning about the additional permissions that are granted to the connected application.

This first login is likely to occur the first time you configure a workspace connection.

It prompts you to confirm those permissions.

If you do not confirm the permissions, then Structural is unable to connect to Salesforce.

Creating the source and destination connections

For a Salesforce workspace, the source and destination data connections must be separate orgs.

The source and destination connections can be production orgs, sandbox orgs, or scratch orgs.

However, the destination connection can only be a scratch org if the source connection is also a scratch org.

Ensuring required Salesforce user permissions

Salesforce users who authorize Structural to connect on their behalf must have the following permissions configured

• Granted the Marketing User option.

• Assigned a role that has edit access for all of the opportunities and cases. In the example below, All Access is an example of a custom role that was granted the required access.

• Assigned the System Administrator profile.

Making the Update Records with Inactive Owners permission available to grant

Before you can grant the Update Records with Inactive Owners permission, you must make sure that it is available to grant.

To make the permission available:

1. Go to Setup > User Interface.

2. Check the Enable “Set Audit Fields upon Record Creation” and “Update Records with Inactive Owners” User Permissions checkbox.

3. Click Save.

Granting the Update Records with Inactive Owners permission

After you enable the permission, to grant it, you can create and assign a permission set.

To display the permission sets page:

1. Go to Setup.

2. Under Administration, click Users, then Permission Sets.

Creating the permission set

To create the permission set:

1. On the Permission Sets page, click New.

1. In the Label field, provide a name for the permission set.

2. Leave License set to None.

3. Click Save.

Assigning the permission to the permission set

To assign the permission to the permission set:

1. On the Permission Sets page, under System, click System Permissions.

1. Under System Permissions, click Edit.

1. Check the Update owner and sharing-based fields with Inactive Owners permission.

1. Click Save and then confirm your changes.

Assigning the permission set to the user

To assign the permission set to your user:

1. From the permission set details, click Manage Assignments.

1. On the Current Assignments page, click Add Assignment.

1. On the Select Users to Assign page, elect the user or users that you intend to use with Structural.

1. Click Next, then confirm the permission set assignments.

Enabling the ability to de-identify Salesforce users

Salesforce workspaces include an .

To allow this option, in the User Management Settings for the destination org, you must enable Scramble Specific Users’ Data.