# Salesforce Platform Event Source Connector for Confluent Cloud The fully managed Salesforce Platform Event Source connector for Confluent Cloud provides a way to subscribe to Salesforce Platform Events and write them to an Apache Kafka® topic. #### NOTE * This Quick Start is for the fully managed Confluent Cloud connector. If you are installing the connector locally for Confluent Platform, see [Salesforce Platform Event Source Connector for Confluent Platform](https://docs.confluent.io/kafka-connectors/salesforce/current/platformevents/index.html). * If you require private networking for fully managed connectors, make sure to set up the proper networking beforehand. For more information, see [Manage Networking for Confluent Cloud Connectors](networking/internet-resource.md#clusters-connect-cloud). * The connector supports Salesforce up to API version 65.0. ## Features The Salesforce Platform Event Source connector provides the following features: * **Uses the Salesforce streaming API**: This connector uses the [Salesforce Streaming API for Platform Events](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/platform_events_intro.htm). * **Set an initial start:** Start consuming new platform events *or* start by consuming all events from the last 72 hours. * **Client-side encryption (CSFLE and CSPE) support**: The connector supports CSFLE and CSPE for sensitive data. For more information about CSFLE or CSPE setup, see the [connector configuration](#cc-salesforce-platform-event-source-setup-connection). * **Supported data formats:** The connector supports Avro, JSON Schema, Protobuf, or JSON (schemaless) output data. [Schema Registry](../get-started/schema-registry.md#cloud-sr-config) must be enabled to use a Schema Registry-based format (for example, Avro, JSON_SR (JSON Schema), or Protobuf). * **Tasks per connector**: Organizations can run multiple connectors with a limit of one task per connector (that is, `"tasks.max": "1"`). * **Offset management capabilities**: Supports offset management. For more information, see [Manage custom offsets](#cc-salesforce-bulk-platform-event-source-custom-offsets). * **Supports multiple platform events**: The connector now supports consuming multiple platform events (up to 5) using a Salesforce [custom channel](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/platform_events_subscribe_custom_channels.htm). To enable this feature: * Configure a custom channel in Salesforce and add all relevant platform events as channel entities. * In the connector configuration, select `CUSTOM_CHANNEL` as the subscription type. * Add a list of the platform events to be supported. * Provide the channel name (which must end with `__chn`). * **Supports automatic topic creation**: The connector now supports automatic topic creation. When using `CUSTOM_CHANNEL` as subscription type, you can add `${_ObjectType}` to the topic name to create different topic names based on the event name. * **Supports Client Credentials flow**: The connector supports authentication using the Client Credentials flow that enables connecting to Salesforce without exposing the user credentials. To use `CLIENT_CREDENTIALS` grant type, you must enable the Client Credentials flow in your connected Salesforce application and assign an integration user. * **Supports OAuth 2.0 Authorization Code grant flow (BYOA)**: The connector supports authentication using the OAuth 2.0 Authorization Code grant flow with your own connected application or external client application (bring your own app), which helps you connect to Salesforce without exposing user credentials. To use the `OAUTH2_AUTH_CODE_BYOA` grant type, provide your application’s consumer key and consumer secret, then complete the authorization by clicking **Connect with Salesforce**. A shared application is not supported. * **Supports Salesforce External Client Apps (ECA)**: This connector supports Salesforce External Client Apps when using the `JWT_BEARER`, `OAUTH2_AUTH_CODE_BYOA`, or `CLIENT_CREDENTIALS` grant type. For more information and examples to use with the Confluent Cloud API for Connect, see the [Confluent Cloud API for Connect Usage Examples](connect-api-section.md#ccloud-connect-api) section. ## Limitations Be sure to review the following information. * For connector limitations, see [Salesforce Platform Event Source Connector](limits.md#cc-salesforce-platform-event-source-limits) limitations. * If you plan to use one or more Single Message Transformations (SMTs), see [SMT Limitations](single-message-transforms.md#cc-single-message-transforms-limitations). ## Manage custom offsets You can manage the offsets for this connector. Offsets provide information on the point in the system from which the connector is accessing data. For more information, see [Manage Offsets for Fully Managed Connectors in Confluent Cloud](offsets.md#connect-custom-offsets). **To manage offsets**: - Manage offsets using Confluent Cloud APIs. For more information, see [Connect offsets API reference](https://docs.confluent.io/cloud/current/ccloud/offsets-connect-v-1/). ### Get the current offset To get the current offset, make a `GET` request that specifies the environment, Kafka cluster, and connector name. ```bash GET /connect/v1/environments/{environment_id}/clusters/{kafka_cluster_id}/connectors/{connector_name}/offsets Host: https://api.confluent.cloud ``` **Response:** Successful calls return HTTP `200` with a JSON payload that describes the offset. ```bash { "id": "lcc-example123", "name": "{connector_name}", "offsets": [ { "partition": {}, "offset": { "replayId": 120572741 } } ], "metadata": { "observed_at": "2024-03-28T17:57:48.139635200Z" } } ``` Responses include the following information: - `replayId` indicates the position of latest offset. - The observed time of the offset in the metadata portion of the payload. The `observed_at` time indicates a snapshot in time for when the API retrieved the offset. A running connector is always updating its offsets. Use `observed_at` to get a sense for the gap between real time and the time at which the request was made. By default, offsets are observed every minute. Calling get repeatedly will fetch more recently observed offsets. - Information about the connector. ### Update the offset To update the offset, make a `POST` request that specifies the environment, Kafka cluster, and connector name. Include a JSON payload that specifies new offset and a patch type. ```bash POST /connect/v1/environments/{environment_id}/clusters/{kafka_cluster_id}/connectors/{connector_name}/offsets/request Host: https://api.confluent.cloud { "type": "PATCH", "offsets": [ { "partition": {}, "offset": { "replayId": 120572000 } } ] } ``` Considerations: - You can only make one offset change at a time for a given connector. - This is an asynchronous request. To check the status of this request, you must use the check offset status API. For more information, see **Get the status of an offset request**. - For source connectors, the connector attempts to read from the position defined by the requested offsets. **Response:** Successful calls return HTTP `202 Accepted` with a JSON payload that describes the offset. ```bash { "id": "lcc-example123", "name": "{connector_name}", "offsets": [ { "partition": {}, "offset": { "replayId": 120572000 } } ], "requested_at": "2024-03-28T17:58:45.606796307Z", "type": "PATCH" } ``` Responses include the following information: - The requested position of the offsets in the source. - The time of the request to update the offset. - Information about the connector. ### Delete the offset To delete the offset, make a `POST` request that specifies the environment, Kafka cluster, and connector name. Include a JSON payload that specifies the delete type. ```bash POST /connect/v1/environments/{environment_id}/clusters/{kafka_cluster_id}/connectors/{connector_name}/offsets/request Host: https://api.confluent.cloud { "type": "DELETE" } ``` Considerations: - Delete requests delete the offset for the provided partition and reset to the base state. A delete request is as if you created a fresh new connector. - This is an asynchronous request. To check the status of this request, you must use the check offset status API. For more information, see **Get the status of an offset request**. - Do not issue delete and patch requests at the same time. - For source connectors, the connector attempts to read from the position defined in the base state. **Response**: Successful calls return HTTP `202 Accepted` with a JSON payload that describes the result. ```bash { "id": "lcc-example123", "name": "{connector_name}", "offsets": [], "requested_at": "2024-03-28T17:59:45.606796307Z", "type": "DELETE" } ``` Responses include the following information: - Empty offsets. - The time of the request to delete the offset. - Information about Kafka cluster and connector. - The type of request. ### Get the status of an offset request To get the status of a previous offset request, make a `GET` request that specifies the environment, Kafka cluster, and connector name. ```bash GET /connect/v1/environments/{environment_id}/clusters/{kafka_cluster_id}/connectors/{connector_name}/offsets/request/status Host: https://api.confluent.cloud ``` Considerations: - The status endpoint always shows the status of the most recent PATCH/DELETE operation. **Response**: Successful calls return HTTP `200` with a JSON payload that describes the result. The following is an example of an applied patch. ```bash { "request": { "id": "lcc-example123", "name": "{connector_name}", "offsets": [], "requested_at": "2024-03-28T17:58:45.606796307Z", "type": "DELETE" }, "status": { "phase": "APPLIED", "message": "The Connect framework-managed offsets for this connector have been altered successfully. However, if this connector manages offsets externally, they will need to be manually altered in the system that the connector uses." }, "previous_offsets": [ { "partition": {}, "offset": { "replayId": 120572741 } } ], "applied_at": "2024-03-28T17:58:48.079141883Z" } ``` Responses include the following information: - The original request, including the time it was made. - The status of the request: applied, pending, or failed. - The time you issued the status request. - The previous offsets. These are the offsets that the connector last updated prior to updating the offsets. Use these to try to restore the state of your connector if a patch update causes your connector to fail or to return a connector to its previous state after rolling back. ### JSON payload The table below offers a description of the unique fields in the JSON payload for managing offsets of the Salesforce Platform Event Source connector. | Field | Definition | Required/Optional | |------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------| | `replayId` | The ReplayId field value, which is populated by the Salesforce system refers to the position of the event in the
event stream. Replay ID values are not guaranteed to be contiguous for consecutive events. For more information,
see [Message Durability](https://developer.salesforce.com/docs/atlas.en-us.api_streaming.meta/api_streaming/using_streaming_api_durability.htm) in the Salesforce documentation. | Required | ## Set up Salesforce authentication #### IMPORTANT In accordance with the Salesforce Winter ‘27 release, Confluent will deprecate the OAuth 2.0 username-password flow (`salesforce.grant.type=PASSWORD`) for Salesforce connectors effective September 15, 2026. Update your connector configurations to use another supported auth grant type. Salesforce connectors authenticate with Salesforce through a connected application or External Client App (ECA). A connected application is a metadata object in Salesforce that defines the protocol (OAuth), the permissions (scopes), and the security policies (for example, IP relaxation and user authorization) for an external application. The consumer key (client ID) and consumer secret (client secret) that you enter in the connector configuration are the credentials of this connected application. The connector supports the following OAuth 2.0 grant types. You select the grant type using the `salesforce.grant.type` configuration property. - `CLIENT_CREDENTIALS`: The connector authenticates with only the consumer key and consumer secret of the connected application. User credentials are not transmitted. - `JWT_BEARER`: The connector authenticates with a JSON Web Token (JWT) signed with a private key. - `OAUTH2_AUTH_CODE_BYOA`: The connector uses the OAuth 2.0 authorization code flow with an application you create and own in your Salesforce org (bring your own application, or BYOA). Confluent Cloud stores a refresh token issued during a one-time browser authorization and uses it to obtain access tokens at runtime. ### Client Credentials flow The OAuth 2.0 Client Credentials flow enables the connector to connect to Salesforce without exposing user credentials. Salesforce requires an execution user (the **Run As** user) for this flow. If no Run As user is defined in the connected application policies, authentication fails with an `invalid_grant` or `no client credentials user enabled` error. #### Configure Salesforce Complete the following steps in Salesforce before you create the connector. 1. Enable the client credentials flow: 1. If you don’t already have a connected application for the connector, enable connected app creation first. Navigate to **Setup > External Client App Settings** and enable **Allow creation of connected apps**. This setting is hidden by default in new Salesforce organizations. 2. Navigate to **Setup > App Manager**. 3. Locate the connected application used for the connector, click the drop-down arrow, and select **Edit**. 4. Under **API (Enable OAuth Settings)**, select **Enable Client Credentials Flow**. This option is often disabled by default for older applications. 5. Save the application definition. 2. Assign the execution user: 1. Navigate to **Setup > Manage Connected Apps**, which is distinct from **App Manager**. 2. Click the name of the connected application. 3. Click **Edit Policies**. 4. Scroll to the **Client Credentials Flow** section. 5. In **Run As**, click the search icon and select the dedicated integration user (for example, `integration.user@example.com`). The Run As user must have the **API Enabled** permission and enough rights to access the objects the connector reads from or writes to. #### Configure the connector Set the following authentication properties in the connector configuration. | Configuration property | Value | Notes | |------------------------------|-----------------------------------------------|--------------------------------------------------------------------------------------------------------------------------| | `salesforce.grant.type` | `CLIENT_CREDENTIALS` | Select this grant type explicitly. | | `salesforce.consumer.key` | Consumer key of the connected application. | Also called the client ID. | | `salesforce.consumer.secret` | Consumer secret of the connected application. | Also called the client secret. | | `salesforce.instance` | `https://.my.salesforce.com` | You must use your My Domain URL. The default value
`https://login.salesforce.com` does not work for this grant type. | | `salesforce.username` | Not used. | The execution user is defined in Salesforce. | | `salesforce.password` | Not used. | The execution user is defined in Salesforce. | The client credentials flow requires your My Domain URL, for example, `https://.my.salesforce.com`, in the `salesforce.instance` property. When a client credentials request is sent to the generic `https://login.salesforce.com` endpoint, the Salesforce global router might fail to identify the tenant-specific policies required to look up the Run As user mapping, and authentication fails. ### JWT Bearer flow The OAuth 2.0 JWT bearer flow establishes trust through public-key cryptography and is the recommended authentication method for production environments. The connector signs a JWT with its private key, identifying the Salesforce user in the `sub` (subject) claim. Salesforce validates the signature using the public certificate uploaded to the connected application and issues an access token. The flow requires no interactive login or password, and is not affected by password expiration policies. #### Configure JWT Bearer Complete the following steps to configure the JWT bearer flow. 1. **Generate a private key and certificate**: Generate a private key and a self-signed certificate using OpenSSL. The following example sets the certificate validity to 3,650 days (10 years) to reduce maintenance overhead. ```bash openssl req -newkey rsa:2048 -nodes -keyout private.key -x509 \ -days 3650 -out public.crt ``` The command generates the following files: - `private.key`: The private key the connector uses to sign the JWT. - `public.crt`: The public certificate you upload to Salesforce. 2. **Create the Java keystore (JKS)**: The connector requires the private key in a JKS container and cannot read the raw PEM files directly. 1. Convert the certificate and private key to PKCS12 format: ```bash openssl pkcs12 -export -in public.crt -inkey private.key \ -out keystore.p12 -name salesforce-cert ``` You are prompted to create an export password. This password becomes the keystore password used in the connector configuration. 2. Import the PKCS12 file into a JKS keystore: ```bash keytool -importkeystore -srckeystore keystore.p12 \ -srcstoretype pkcs12 -destkeystore salesforce.jks \ -deststoretype JKS ``` Upload the resulting `salesforce.jks` file when you configure the connector. #### Configure the Salesforce connected application Complete the following steps in Salesforce before you create the connector. 1. If you don’t already have a connected application for the connector, enable connected app creation first. Navigate to **Setup > External Client App Settings** and enable **Allow creation of connected apps**. This setting is hidden by default in new Salesforce organizations. 2. Navigate to **Setup > App Manager** and edit the connected application used for the connector. 3. Under **API (Enable OAuth Settings)**, select **Use digital signatures**, click **Choose File**, and upload the `public.crt` file. 4. Ensure the `api`, `refresh_token`, and `offline_access` OAuth scopes are selected. 5. Pre-authorize users. Navigate to **Setup > Manage Connected Apps**, click **Edit Policies**, and change **Permitted Users** to **Admin approved users are pre-authorized**. The JWT Bearer flow is automated, and the connector cannot approve a consent screen, so you must be pre-authorized. 6. Assign profiles. In **Manage Connected Apps**, scroll to **Profiles** (or **Permission Sets**) and add the profile of the integration user, for example, a custom integration profile. #### Configure the connector Set the following authentication properties in the connector configuration. | Configuration property | Value | Notes | |------------------------------------|--------------------------------------------|----------------------------------------------------------------------------------------------| | `salesforce.grant.type` | `JWT_BEARER` | Select this grant type explicitly. | | `salesforce.consumer.key` | Consumer key of the connected application. | Also called the client ID. | | `salesforce.username` | Username of the integration user | Sets the `sub` claim of the JWT. The username must match a user
in the assigned profile. | | `salesforce.jwt.keystore.file` | The `salesforce.jks` file | Upload the file when you configure the connector. | | `salesforce.jwt.keystore.password` | Keystore password | The export password set during the PKCS12 conversion. | | `salesforce.instance` | `https://.my.salesforce.com` | Use your My Domain URL for best results. | | `salesforce.password` | Not used | Not required for this grant type. | | `salesforce.consumer.secret` | Not used | The signed JWT replaces the consumer secret. | ### Authorization Code flow (Bring your own application) The OAuth 2.0 authorization code flow (also called the web server flow) lets the connector access Salesforce on behalf of a user without storing the user’s password. In the bring your own application (BYOA) model, you create and own the application in your Salesforce org, authorize the connector once in a browser, and Salesforce issues a refresh token that Confluent Cloud stores and uses to obtain access tokens automatically. As of Salesforce Spring ‘26, create an ECA instead of a new connected application; existing connected applications continue to work. #### Configure the Salesforce application Complete the following steps in Salesforce before you create the connector. 1. Enable OAuth and set the callback URL: 1. Navigate to **Setup > App Manager** to edit an existing connected application, or **Setup > External Client App Manager > New External Client App** to create a new application. 2. Under **API (Enable OAuth Settings)**, select **Enable OAuth Settings**. 3. In **Callback URL**, enter `https://confluent.cloud/api/connect/oauth/callback`. 2. Select the OAuth scopes: 1. **Manage user data via APIs** (`api`). 2. **Perform requests at any time** (`refresh_token`, `offline_access`). 3. Enable the web server flow. For an ECA, under **Flow Enablement**, select **Enable Authorization Code and Credentials Flow**. 4. Set the OAuth security policies: 1. Select **Require Secret for Web Server Flow**. 2. Select **Require Secret for Refresh Token Flow**. 3. Disable **Require Proof Key for Code Exchange (PKCE)**. 4. Disable **Enable Refresh Token Rotation**. Rotation would invalidate the token and the connector would require manual re-authorization. 5. Configure the refresh token policy so the token does not expire immediately. Preferably set the refresh token policy to **Valid Until Revoked** to avoid manual re-authorization on token expiry. #### Configure the connector Set the following authentication properties in the connector configuration. | Configuration property | Value | Notes | |------------------------------|---------------------------------------------------------------------------------------------|------------------------------------------------------------------------------| | `salesforce.grant.type` | `OAUTH2_AUTH_CODE_BYOA` | Select this grant type explicitly. | | `salesforce.consumer.key` | Consumer key of the application. | Also called the client ID. | | `salesforce.consumer.secret` | Consumer secret of the application. | Also called the client secret. | | `salesforce.instance` | `https://login.salesforce.com` (production) or
`https://test.salesforce.com` (sandbox). | Using your My Domain URL is recommended, but the default URLs
also work. | #### Authorize the connector Click **Connect with Salesforce**, then complete the Salesforce login and consent prompt. Salesforce redirects back to Confluent Cloud, which stores the refresh token. You can then continue and launch the connector. ### Troubleshoot authentication errors The following table lists common authentication errors and how to resolve them. | Error | Grant type | Probable cause | Resolution | |-------------------------------------------------------------------------------------------------|-------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `invalid_grant` | `CLIENT_CREDENTIALS` | No Run As user is defined for the connected application. | Define the execution user in the connected application policies. | | `invalid_grant` | `CLIENT_CREDENTIALS` | Wrong instance URL. | Set `salesforce.instance` to your My Domain URL. | | `invalid_app_access` | `CLIENT_CREDENTIALS` | The user is not admin-approved to access the connected application. | In **Manage Connected Apps**, open the connected application, click
**Manage Profiles**, and add the profile of the integration user. | | `invalid_client` | All grant types | Wrong consumer key or consumer secret. | Verify the consumer key and consumer secret. Check for trailing
spaces. | | `invalid_grant: audience is invalid` | `JWT_BEARER` | Wrong audience in the JWT claim. | Ensure `salesforce.instance` matches the audience Salesforce
expects, which is typically your My Domain URL. | | `ConnectException: Connection refused` | All grant types | The network blocks the connection. | Check firewall and proxy settings, and verify that the Salesforce
URL is reachable. | | `400 Bad Request` | `CLIENT_CREDENTIALS` | The Client Credentials flow is disabled for the connected application. | In **App Manager**, edit the connected application and select **Enable
Client Credentials Flow**. | | `Job creation failed` | All grant types | The integration user has insufficient permissions. | Grant the integration user the **API Enabled** permission and
create and read permissions on the target objects. | | `invalid_grant` (“expired access/refresh token”) | `OAUTH2_AUTH_CODE_BYOA` | The refresh token expired, was revoked, or was rotated. | Manually re-authorize with **Connect with Salesforce**, and
preferably set the refresh token policy to **Valid Until Revoked**
and disable refresh token rotation. | | `invalid_grant` (“expired access/refresh token”) on a connector
that was previously working | `OAUTH2_AUTH_CODE_BYOA` | Salesforce allows only five unique OAuth approvals per user per
connected application. Each refresh token counts as an approval, and a new
approval beyond the limit revokes the oldest. Sharing one
Salesforce user and connected application across multiple connectors (or
re-authorizing repeatedly) exhausts this limit and revokes an
older connector’s refresh token. | Use a dedicated Salesforce user for each connector (a shared
connected application is fine as long as the user differs), and avoid
unnecessary re-authorizations. Then re-authorize the affected
connector with **Connect with Salesforce**. For more information,
see Salesforce’s [Manage OAuth-Enabled Connected Apps’ Access](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_request_manage.htm&type=5)
documentation. | ## Quick Start Use this quick start to get up and running with the Salesforce Platform Event Source connector. The quick start provides the basics of selecting the connector and configuring it to subscribe to a Salesforce Platform Event. Prerequisites : - Authorized access to a [Confluent Cloud](https://www.confluent.io/confluent-cloud/) cluster on Amazon Web Services (AWS), Microsoft Azure (Azure), or Google Cloud. - The Confluent CLI installed and configured for the cluster. See [Install the Confluent CLI](https://docs.confluent.io/confluent-cli/current/install.html). - [Schema Registry](../get-started/schema-registry.md#cloud-sr-config) must be enabled to use a Schema Registry-based format (for example, Avro, JSON_SR (JSON Schema), or Protobuf). - **At least one topic must exist** in your Confluent Cloud cluster before creating the connector. - The Salesforce account should have at least one Platform Event to subscribe to. You will need to know the security token, key, and secret used for the Salesforce account when setting up the connector. - For networking considerations, see [Networking and DNS](overview.md#connect-internet-access-resources). To use a set of public egress IP addresses, see [Public Egress IP Addresses for Confluent Cloud Connectors](static-egress-ip.md#cc-static-egress-ips). - Before you configure the connector, ensure the Salesforce user account has the following permissions: * **Single Event:** * **API Enabled** permission. * **Read** access to the specific Platform Event. * **Multiple Events (Custom Channel):** * **API Enabled** permission. * **View Setup and Configuration** permission. * **Read** access to the relevant Platform Events. * If you want to create or update a custom channel, you need the **Customize Application** permission.
- Kafka cluster credentials. The following lists the different ways you can provide credentials. - Enter an existing [service account](service-account.md#s3-cloud-service-account) resource ID. - Create a Confluent Cloud [service account](service-account.md#s3-cloud-service-account) for the connector. Make sure to review the ACL entries required in the [service account documentation](service-account.md#s3-cloud-service-account). Some connectors have specific ACL requirements. - Create a Confluent Cloud API key and secret. To create a key and secret, you can use [confluent api-key create](https://docs.confluent.io/confluent-cli/current/command-reference/api-key/confluent_api-key_create.html) *or* you can autogenerate the API key and secret directly in the Cloud Console when setting up the connector. ### Using the Confluent Cloud Console #### Step 1: Launch your Confluent Cloud cluster To create and launch a Kafka cluster in Confluent Cloud, see [Create a kafka cluster in Confluent Cloud](../get-started/index.md#cloud-create-kafka-cluster). #### Step 2: Add a connector In the left navigation menu, click **Connectors**. If you already have connectors in your cluster, click **+ Add connector**. #### Step 3: Select your connector Click the **Salesforce Platform Event Source** connector card. ![Salesforce Platform Event Source Connector Card](images/ccloud-salesforce-platform-event-source-icon.png) #### IMPORTANT At least one topic must exist in your Confluent Cloud cluster before creating the connector. #### Step 4: Enter the connector details #### NOTE * Make sure you have all your [prerequisites](#cc-salesforce-platform-event-source-prereqs) completed. * An asterisk ( \* ) designates a required entry. At the **Add Salesforce Platform Event Source Connector** screen, complete the following: ### Topic selection Select the topic you want to send data to from the **Topics** list. To create a new topic, click **+Add new topic**. #### NOTE If `kafka.topic.lowercase` is set to `true`, the connector converts the selected topic name to lowercase. If a topic with that lowercase name does not exist, a new one is created. If you are updating a fully managed connector with this configuration via the CLI, API, or Terraform, you must first update the Service Account’s Topic ACL. ### Kafka access 1. Select the way you want to provide **Kafka Cluster credentials**. You can choose one of the following options: - **My account**: This setting allows your connector to globally access everything that you have access to. With a user account, the connector uses an API key and secret to access the Kafka cluster. This option is not recommended for production. - **Service account**: This setting limits the access for your connector by using a [service account](service-account.md#s3-cloud-service-account). This option is recommended for production. - **Use an existing API key**: This setting allows you to specify an API key and a secret pair. You can use an existing pair or create a new one. This method is not recommended for production environments. #### NOTE Freight clusters support only service accounts for Kafka authentication. 2. Click **Continue**. ### Authentication 1. Configure the authentication properties: - **Salesforce grant type**: Sets the authentication grant type to `PASSWORD` , `JWT_BEARER` ([Salesforce JSON Web Token (JWT)](https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_jwt_flow.htm&type=5)) or `CLIENT_CREDENTIALS`. Defaults to `PASSWORD`. **Salesforce details** - **Salesforce instance**: The URL of the Salesforce endpoint to use. The default is [https://login.salesforce.com](https://login.salesforce.com). This directs the connector to use the endpoint specified in the authentication response. - **Salesforce username**: The Salesforce username for the connector to use. - **Salesforce password**: The Salesforce password for the connector to use. - **Salesforce password token**: The Salesforce security token associated with the username. - **Salesforce consumer key**: The consumer key for the OAuth application. - **Salesforce consumer secret**: The consumer secret for the OAuth application. - **Salesforce JWT keystore file**: If using the grant type `JWT_BEARER`, upload the JWT keystore file. - **Salesforce JWT keystore password**: The password used to access the JWT keystore file. #### NOTE The following properties are used based on the **Salesforce grant type** you choose. - `JWT_BEARER`: Requires username, consumer key, JWT keystore file, and JWT keystore password. - `PASSWORD`: Requires username, password, password token, consumer key, and consumer secret. - `CLIENT_CREDENTIALS`: Requires the client ID and client secret of a Salesforce connected application as the consumer key and consumer secret, and the Salesforce domain URL in the Salesforce instance option. The default value [https://login.salesforce.com](https://login.salesforce.com) does not work for this option. To use `CLIENT_CREDENTIALS`, you must enable the Client Credentials flow in your connected Salesforce application and assign an integration user. - `OAUTH2_AUTH_CODE_BYOA`: Requires consumer key and consumer secret (the consumer key and consumer secret of your Salesforce connected application or external client application). After you enter these values, complete the authorization by clicking **Connect with Salesforce** to perform the OAuth 2.0 handshake and store the refresh token. Only bring your own application (BYOA) is supported. A shared application is not supported. Confluent recommends using the My Domain URL, although the default URLs also work. 2. Click **Continue**. ### Configuration - **Platform Event Subscription Type**: The type of subscription used for platform events. Use SINGLE_EVENT for individual platform events and CUSTOM_CHANNEL for custom channels that can aggregate multiple platform events in a custom channel. - **Platform Event Name**: The platform event name (`SINGLE_EVENT` mode only). - **Custom Channel Name**: The custom channel name (`CUSTOM_CHANNEL` mode only). - **Platform Events List**: The list of platform events in the custom channel (`CUSTOM_CHANNEL` mode only). - **Salesforce initial start**: Specifies the initial starting point for the connector. Allowed values are `latest` (only read events that arrive after the connector has started) and `all` (read all events including past events from the beginning of the Event Bus). The default value is `latest`. **Output messages** - **Select output record value format**: Select the output record value format (data going to the Kafka topic). Valid values are AVRO, JSON, JSON_SR (JSON Schema), or PROTOBUF. [Schema Registry](../get-started/schema-registry.md#cloud-sr-config) must be enabled to use a Schema Registry-based format (for example, Avro, JSON Schema, or Protobuf). **Data encryption** - Enable **Client-Side Field Level Encryption** for data encryption. Specify a **Service Account** to access the Schema Registry and associated encryption rules or keys with that schema. For more information on CSFLE or CSPE setup, see [Manage encryption for connectors](csfle.md#connect-csfle). ### **Show advanced configurations** - **Schema context**: Select a schema context to use for this connector, if using a schema-based data format. This property defaults to the **Default** context, which configures the connector to use the default schema set up for Schema Registry in your Confluent Cloud environment. A schema context allows you to use separate schemas (like schema sub-registries) tied to topics in different Kafka clusters that share the same Schema Registry environment. For example, if you select a non-default context, a **Source** connector uses only that schema context to register a schema and a **Sink** connector uses only that schema context to read from. For more information about setting up a schema context, see [What are schema contexts and when should you use them?](../sr/faqs-cc.md#faq-schema-contexts). **Additional Configs** - **value.converter.replace.null.with.default**: Whether to replace fields that have a default value and that are null to the default value. When set to true, the default value is used, otherwise null is used. Applicable for JSON Converter. - **Value Converter Reference Subject Name Strategy**: Sets the subject reference name strategy for values. Valid entries are `DefaultReferenceSubjectNameStrategy` or `QualifiedReferenceSubjectNameStrategy`. You can use this strategy only with `PROTOBUF` format; the default strategy is `DefaultReferenceSubjectNameStrategy`. - **value.converter.schemas.enable**: Include schemas within each of the serialized values. Input messages must contain schema and payload fields and may not contain additional fields. For plain JSON data, set this to false. Applicable for JSON Converter. - **errors.tolerance**: Use this property if you would like to configure the connector’s error handling behavior. WARNING: This property should be used with CAUTION for SOURCE CONNECTORS as it may lead to dataloss. If you set this property to ‘all’, the connector will not fail on errant records, but will instead log them (and send to DLQ for Sink Connectors) and continue processing. If you set this property to ‘none’, the connector task will fail on errant records. - **value.converter.ignore.default.for.nullables**: When set to true, this property ensures that the corresponding record in Kafka is NULL, instead of showing the default column value. Applicable for AVRO,PROTOBUF and JSON_SR Converters. - **Value Converter Decimal Format**: Specifies the `JSON` or `JSON_SR` serialization format for Connect `DECIMAL` logical type values with two allowed literals: `BASE64` to serialize `DECIMAL` logical types as base64 encoded binary data, and `NUMERIC` to serialize `DECIMAL` logical type values in `JSON` or `JSON_SR` as a number representing the decimal value. - **Key Converter Schema ID Serializer**: The class name of the schema ID serializer for keys. This is used to serialize schema IDs in the message headers. - **Value Converter Connect Meta Data**: Enables the Connect converter to add its metadata to the output schema. Applies to Avro converters. - **Value Converter Value Subject Name Strategy**: Determines how to construct the subject name under which the value schema is registered with Schema Registry. - **Key Converter Key Subject Name Strategy**: Determines how to construct the subject name for key schema registration. - **Value Converter Schema ID Serializer**: The class name of the schema ID serializer for values. This is used to serialize schema IDs in the message headers. - **kafka.topic.lowercase**: Flag to determine if the associated topic should be converted to lowercase. - **invalid.replay.id.behaviour**: Determine if the connector should fallback to fetching all or latest events if invalid or expired replayId is provided. : NOTE: Salesforce only retains events for 24 hours (standard-volume) or 72 hours (high-volume or CDC), and events outside this window are unrecoverable regardless of fallback mode. **Auto-restart policy** - **Enable Connector Auto-restart**: Enables the auto-restart behavior of the connector and its task in the event of user-actionable errors. Defaults to `true`, enabling the connector to automatically restart in case of user-actionable errors. Set this property to `false` to disable auto-restart for failed connectors. If disabled, you must manually restart the connector. **Connection details** - **Max retry time (ms)**: Maximum time in milliseconds until the connector stops retrying failed Salesforce requests. Default is `30000` and minimum is `1000`. **Transforms** - **Single Message Transformations**: To add a new SMT, see [Add transforms](single-message-transforms.md#cc-single-message-transforms-ui). For more information about unsupported SMTs, see [Unsupported transformations](single-message-transforms.md#cc-single-message-transforms-unsupported-transforms). **Processing position** - **Set offsets**: Click **Set offsets** to define a specific offset for this connector to begin procession data from. For more information on managing offsets, see [Manage offsets](offsets.md#connect-custom-offsets). See [Configuration Properties](#cc-salesforce-platform-event-source-config-properties) for all property values and definitions. - Click **Continue**. ### Sizing Based on the number of topic partitions you select, you will be provided with a recommended number of tasks. 1. To change the number of tasks, use the Range Slider to select the desired number of tasks. 2. Click **Continue**. ### Review and Launch 1. Verify the connection details by previewing the running configuration. 2. Once you’ve validated that the properties are configured to your satisfaction, click **Launch**. The status for the connector should go from **Provisioning** to **Running**. #### Step 5: Check the Kafka topic After the connector is running, verify that messages are populating your Kafka topic. For more information and examples to use with the Confluent Cloud API for Connect, see the [Confluent Cloud API for Connect Usage Examples](connect-api-section.md#ccloud-connect-api) section. ### Using the Confluent CLI Complete the following steps to set up and run the connector using the Confluent CLI. #### IMPORTANT * Make sure you have all your [prerequisites](#cc-salesforce-platform-event-source-prereqs) completed. * At least one topic must exist in your Confluent Cloud cluster before creating the connector. #### Step 1: List the available connectors Enter the following command to list available connectors: ```none confluent connect plugin list ``` #### Step 2: List the connector configuration properties Enter the following command to show the connector configuration properties: ```none confluent connect plugin describe ``` The command output shows the required and optional configuration properties. #### Step 3: Create the connector configuration file Create a JSON file that contains the connector configuration properties. The following example shows the required connector properties. ```none { "connector.class": "SalesforcePlatformEventSource", "name": "SalesforcePlatformEventSource_0", "kafka.auth.mode": "KAFKA_API_KEY", "kafka.api.key": "****************", "kafka.api.secret": "**********************************************", "kafka.topic": "testplatformevent", "salesforce.grant.type": "PASSWORD", "salesforce.instance": "https://login.salesforce.com", "salesforce.username": "", "salesforce.password": "**************", "salesforce.password.token": "************************", "salesforce.consumer.key": "******************************************", "salesforce.consumer.secret": "***************************************", "salesforce.platform.subscription.type": "SINGLE_EVENT", "salesforce.platform.event.name": "TestEvent__e", "output.data.format": "JSON", "tasks.max": "1" } ``` Note the following property definitions: * `"connector.class"`: Identifies the connector plugin name. * `"name"`: Sets a name for your new connector. * `"kafka.auth.mode"`: Identifies the connector authentication mode you want to use. There are two options: `SERVICE_ACCOUNT` or `KAFKA_API_KEY` (the default). To use an API key and secret, specify the configuration properties `kafka.api.key` and `kafka.api.secret`, as shown in the example configuration (above). To use a [service account](service-account.md#s3-cloud-service-account), specify the **Resource ID** in the property `kafka.service.account.id=`. To list the available service account resource IDs, use the following command: ```bash confluent iam service-account list ``` For example: ```bash confluent iam service-account list Id | Resource ID | Name | Description +---------+-------------+-------------------+------------------- 123456 | sa-l1r23m | sa-1 | Service account 1 789101 | sa-l4d56p | sa-2 | Service account 2 ``` * `"kafka.topic"`: Enter the name of the Kafka topic or topics. Note that Kafka topic names are converted to all lower case letters. * `"salesforce.grant.type"`: Sets the authentication grant type to `PASSWORD` (username+password) , `JWT_BEARER` ([Salesforce JSON Web Token (JWT)](https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_jwt_flow.htm&type=5)) or `CLIENT_CREDENTIALS`. Defaults to `PASSWORD`. #### NOTE The following properties are used based on the **Salesforce grant type** you choose. - `JWT_BEARER`: Requires username, consumer key, JWT keystore file, and JWT keystore password. - `PASSWORD`: Requires username, password, password token, consumer key, and consumer secret. - `CLIENT_CREDENTIALS`: Requires the client ID and client secret of a Salesforce connected application as the consumer key and consumer secret, and the Salesforce domain URL in the Salesforce instance option. The default value [https://login.salesforce.com](https://login.salesforce.com) does not work for this option. To use `CLIENT_CREDENTIALS`, you must enable the Client Credentials flow in your connected Salesforce application and assign an integration user. - `OAUTH2_AUTH_CODE_BYOA`: Requires consumer key and consumer secret (the consumer key and consumer secret of your Salesforce connected application or external client application). After you enter these values, complete the authorization by clicking **Connect with Salesforce** to perform the OAuth 2.0 handshake and store the refresh token. Only bring your own application (BYOA) is supported. A shared application is not supported. Confluent recommends using the My Domain URL, although the default URLs also work. * `"salesforce.username"`: The Salesforce username for the connector to use. * `"salesforce.password"`: The Salesforce username password. * `"salesforce.password.token"`: The Salesforce security token associated with the username. * `"salesforce.consumer.key"`: The consumer key for the OAuth application. * `"salesforce.consumer.secret"`: The consumer secret for the OAuth application. * `"salesforce.jwt.keystore.file"`: Salesforce JWT keystore file. The JWT keystore file is a binary file and you supply the contents of the file in the property encoded in Base64. To use the `salesforce.jwt.keystore.file` property, encode the keystore contents in Base64, take the encoded string, add the `data:text/plain:base64` prefix, and then use the entire string as the property entry. For example: ```properties "salesforce.jwt.keystore.file" : "data:text/plain;base64,/u3+7QAAAAIAAAACAAAAGY2xpZ...==", "salesforce.jwt.keystore.password" : "", ``` * `"salesforce.jwt.keystore.password"`: Enter the password used to access the JWT keystore file. * `"salesforce.platform.subscription.type"`: The subscription type. Use SINGLE_EVENT for individual platform events and CUSTOM_CHANNEL for custom channels. * `"salesforce.platform.event.name"`: The event name. This name is case sensitive. * `"output.data.format"`: Sets the output Kafka record value format (data coming from the connector). Valid entries are **AVRO**, **JSON_SR**, **PROTOBUF**, or **JSON**. You must have Confluent Cloud Schema Registry configured if using a schema-based message format (for example, Avro, JSON_SR (JSON Schema), or Protobuf). * `"tasks.max"`: Enter the number of [tasks](/platform/current/connect/concepts.html#tasks) in use by the connector. Organizations can run multiple connectors with a limit of one task per connector (that is, `"tasks.max": "1"`). #### NOTE To enable CSFLE or CSPE for data encryption, specify the following properties: * `csfle.enabled`: Flag to indicate whether the connector honors CSFLE or CSPE rules. * `sr.service.account.id`: A Service Account to access the Schema Registry and associated encryption rules or keys with that schema. For more information on CSFLE or CSPE setup, see [Manage encryption for connectors](csfle.md#connect-csfle). **SMTs**: For details about adding SMTs using the Confluent CLI, see the [Single Message Transformations](single-message-transforms.md#cc-single-message-transforms) documentation. See [Configuration Properties](#cc-salesforce-platform-event-source-config-properties) for all property values and descriptions. #### Step 4: Load the properties file and create the connector Enter the following command to load the configuration and start the connector: ```none confluent connect cluster create --config-file .json ``` For example: ```none confluent connect cluster create --config-file salesforce-platform-event-source.json ``` Example output: ```none Created connector SalesforcePlatformEventSource_0 lcc-aj3qr ``` #### Step 5: Check the connector status Enter the following command to check the connector status: ```none confluent connect cluster list ``` Example output: ```none ID | Name | Status | Type +-----------+----------------------------------+---------+-------+ lcc-aj3qr | SalesforcePlatformEventSource_0 | RUNNING | source ``` #### Step 6: Check the Kafka topic. After the connector is running, verify that messages are populating your Kafka topic. For more information and examples to use with the Confluent Cloud API for Connect, see the [Confluent Cloud API for Connect Usage Examples](connect-api-section.md#ccloud-connect-api) section. ## Configuration Properties Use the following configuration properties with the fully managed connector. For self-managed connector property definitions and other details, see the connector docs in [Self-managed connectors for Confluent Platform](/platform/current/connect/kafka_connectors.html). ### How should we connect to your data? `name` : Sets a name for your connector.
* Type: string * Valid Values: A string at most 64 characters long * Importance: high ### Kafka Cluster credentials `kafka.auth.mode` : Kafka Authentication mode. It can be one of KAFKA_API_KEY or SERVICE_ACCOUNT. It defaults to KAFKA_API_KEY mode, whenever possible.
* Type: string * Valid Values: SERVICE_ACCOUNT, KAFKA_API_KEY * Importance: high `kafka.api.key` : Kafka API Key. Required when kafka.auth.mode==KAFKA_API_KEY.
* Type: password * Importance: high `kafka.service.account.id` : The Service Account that will be used to generate the API keys to communicate with Kafka Cluster.
* Type: string * Importance: high `kafka.api.secret` : Secret associated with Kafka API key. Required when kafka.auth.mode==KAFKA_API_KEY.
* Type: password * Importance: high ### Which topic do you want to send data to? `kafka.topic` : Identifies the topic name to write the data to.
* Type: string * Importance: high ### Schema Config `schema.context.name` : Add a schema context name. A schema context represents an independent scope in Schema Registry. It is a separate sub-schema tied to topics in different Kafka clusters that share the same Schema Registry instance. If not used, the connector uses the default schema configured for Schema Registry in your Confluent Cloud environment.
* Type: string * Default: default * Importance: medium ### How should we connect to Salesforce? `salesforce.grant.type` : Grant type the connector uses for Salesforce authentication: PASSWORD, CLIENT_CREDENTIALS, JWT_BEARER, or OAUTH2_AUTH_CODE_BYOA (OAuth 2.0 Authorization Code with your own connected app)
* Type: string * Default: PASSWORD * Importance: high `salesforce.instance` : Salesforce endpoint URL the connector uses for API requests. For CLIENT_CREDENTIALS and the OAuth 2.0 Authorization Code grant, set this to your org’s My Domain URL (for example [https://MyDomainName.my.salesforce.com](https://MyDomainName.my.salesforce.com)). Defaults to [https://login.salesforce.com](https://login.salesforce.com).
* Type: string * Default: [https://login.salesforce.com](https://login.salesforce.com) * Importance: high `salesforce.username` : Salesforce username for connector authentication
* Type: string * Importance: high `salesforce.password` : Salesforce account password for connector authentication
* Type: password * Importance: high `salesforce.password.token` : Security token associated with the Salesforce username
* Type: password * Importance: high `salesforce.consumer.key` : Client ID (consumer key) for the Salesforce connected app
* Type: password * Importance: high `salesforce.consumer.secret` : Client secret (consumer secret) for the Salesforce connected app
* Type: password * Importance: medium `salesforce.jwt.keystore.file` : Keystore file that stores the private key for JWT authentication
* Type: password * Default: [hidden] * Importance: medium `salesforce.jwt.keystore.password` : Password that unlocks the JWT keystore file
* Type: password * Importance: medium `salesforce.platform.subscription.type` : SINGLE_EVENT for individual platform events, CUSTOM_CHANNEL for custom channels that aggregate multiple platform events
* Type: string * Default: SINGLE_EVENT * Importance: high `salesforce.platform.event.name` : Platform event name (SINGLE_EVENT mode only)
* Type: string * Importance: high `salesforce.platform.custom.channel.name` : Custom channel name (CUSTOM_CHANNEL mode only)
* Type: string * Importance: high `salesforce.platform.channel.entities` : List of platform events in custom channel (CUSTOM_CHANNEL mode only)
* Type: list * Importance: medium `oauth.refresh.token` : OAuth 2.0 refresh token. Populated by Confluent Cloud after authorization.
* Type: password * Importance: high ### Connection details `salesforce.initial.start` : Specify the initial starting point for the connector. Allowed values are
latest: only read events that arrive after the connector has started.
all: read all events including past events from the beginning of the Event Bus.
The default value is latest.
* Type: string * Default: latest * Importance: medium `connection.timeout` : The amount of time to wait in milliseconds while connecting to the Salesforce streaming endpoint.
* Type: long * Default: 30000 * Importance: low `request.max.retries.time.ms` : Maximum time in milliseconds until the connector stops retrying failed Salesforce requests. Default is 30000 and minimum is 1000.
* Type: long * Default: 30000 (30 seconds) * Valid Values: [1000,…,250000] * Importance: low ### Output messages `output.data.format` : Sets the output Kafka record value format. Valid entries are AVRO, JSON_SR, PROTOBUF, or JSON. Note that you need to have Confluent Cloud Schema Registry configured if using a schema-based message format like AVRO, JSON_SR, and PROTOBUF
* Type: string * Default: JSON * Importance: high ### Number of tasks for this connector `tasks.max` : Maximum number of tasks for the connector.
* Type: int * Valid Values: [1,…,1] * Importance: high ### Additional Configs `header.converter` : The converter class for the headers. This is used to serialize and deserialize the headers of the messages.
* Type: string * Importance: low `producer.override.compression.type` : The compression type for all data generated by the producer. Valid values are none, gzip, snappy, lz4, and zstd.
* Type: string * Importance: low `producer.override.linger.ms` : The producer groups together any records that arrive in between request transmissions into a single batched request. More details can be found in the documentation: [https://docs.confluent.io/platform/current/installation/configuration/producer-configs.html#linger-ms](https://docs.confluent.io/platform/current/installation/configuration/producer-configs.html#linger-ms).
* Type: long * Valid Values: [100,…,1000] * Importance: low `value.converter.allow.optional.map.keys` : Allow optional string map key when converting from Connect Schema to Avro Schema. Applicable for Avro Converters.
* Type: boolean * Importance: low `value.converter.auto.register.schemas` : Specify if the Serializer should attempt to register the Schema.
* Type: boolean * Importance: low `value.converter.connect.meta.data` : Allow the Connect converter to add its metadata to the output schema. Applicable for Avro Converters.
* Type: boolean * Importance: low `value.converter.enhanced.avro.schema.support` : Enable enhanced schema support to preserve package information and Enums. Applicable for Avro Converters.
* Type: boolean * Importance: low `value.converter.enhanced.protobuf.schema.support` : Enable enhanced schema support to preserve package information. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.flatten.unions` : Whether to flatten unions (oneofs). Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.generate.index.for.unions` : Whether to generate an index suffix for unions. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.generate.struct.for.nulls` : Whether to generate a struct variable for null values. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.int.for.enums` : Whether to represent enums as integers. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.latest.compatibility.strict` : Verify latest subject version is backward compatible when use.latest.version is true.
* Type: boolean * Importance: low `value.converter.object.additional.properties` : Whether to allow additional properties for object schemas. Applicable for JSON_SR Converters.
* Type: boolean * Importance: low `value.converter.optional.for.nullables` : Whether nullable fields should be specified with an optional label. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.optional.for.proto2` : Whether proto2 optionals are supported. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.scrub.invalid.names` : Whether to scrub invalid names by replacing invalid characters with valid characters. Applicable for Avro and Protobuf Converters.
* Type: boolean * Importance: low `value.converter.use.latest.version` : Use latest version of schema in subject for serialization when auto.register.schemas is false.
* Type: boolean * Importance: low `value.converter.use.optional.for.nonrequired` : Whether to set non-required properties to be optional. Applicable for JSON_SR Converters.
* Type: boolean * Importance: low `value.converter.wrapper.for.nullables` : Whether nullable fields should use primitive wrapper messages. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `value.converter.wrapper.for.raw.primitives` : Whether a wrapper message should be interpreted as a raw primitive at root level. Applicable for Protobuf Converters.
* Type: boolean * Importance: low `kafka.topic.lowercase` : Flag to determine if the associated topic should be converted to lowercase
* Type: boolean * Default: true * Importance: high `errors.tolerance` : Use this property if you would like to configure the connector’s error handling behavior. WARNING: This property should be used with CAUTION for SOURCE CONNECTORS as it may lead to dataloss. If you set this property to ‘all’, the connector will not fail on errant records, but will instead log them (and send to DLQ for Sink Connectors) and continue processing. If you set this property to ‘none’, the connector task will fail on errant records.
* Type: string * Default: none * Importance: low `key.converter.key.schema.id.serializer` : The class name of the schema ID serializer for keys. This is used to serialize schema IDs in the message headers.
* Type: string * Default: io.confluent.kafka.serializers.schema.id.PrefixSchemaIdSerializer * Importance: low `key.converter.key.subject.name.strategy` : How to construct the subject name for key schema registration.
* Type: string * Default: TopicNameStrategy * Importance: low `value.converter.decimal.format` : Specify the JSON/JSON_SR serialization format for Connect DECIMAL logical type values with two allowed literals:
BASE64 to serialize DECIMAL logical types as base64 encoded binary data and
NUMERIC to serialize Connect DECIMAL logical type values in JSON/JSON_SR as a number representing the decimal value.
* Type: string * Default: BASE64 * Importance: low `value.converter.flatten.singleton.unions` : Whether to flatten singleton unions. Applicable for Avro and JSON_SR Converters.
* Type: boolean * Default: false * Importance: low `value.converter.ignore.default.for.nullables` : When set to true, this property ensures that the corresponding record in Kafka is NULL, instead of showing the default column value. Applicable for AVRO,PROTOBUF and JSON_SR Converters.
* Type: boolean * Default: false * Importance: low `value.converter.reference.subject.name.strategy` : Set the subject reference name strategy for value. Valid entries are DefaultReferenceSubjectNameStrategy or QualifiedReferenceSubjectNameStrategy. Note that the subject reference name strategy can be selected only for PROTOBUF format with the default strategy being DefaultReferenceSubjectNameStrategy.
* Type: string * Default: DefaultReferenceSubjectNameStrategy * Importance: low `value.converter.replace.null.with.default` : Whether to replace fields that have a default value and that are null to the default value. When set to true, the default value is used, otherwise null is used. Applicable for JSON Converter.
* Type: boolean * Default: true * Importance: low `value.converter.schemas.enable` : Include schemas within each of the serialized values. Input messages must contain schema and payload fields and may not contain additional fields. For plain JSON data, set this to false. Applicable for JSON Converter.
* Type: boolean * Default: false * Importance: low `value.converter.value.schema.id.serializer` : The class name of the schema ID serializer for values. This is used to serialize schema IDs in the message headers.
* Type: string * Default: io.confluent.kafka.serializers.schema.id.PrefixSchemaIdSerializer * Importance: low `value.converter.value.subject.name.strategy` : Determines how to construct the subject name under which the value schema is registered with Schema Registry.
* Type: string * Default: TopicNameStrategy * Importance: low `invalid.replay.id.behaviour` : Determine if the connector should fallback to fetching all or latest events if invalid or expired replayId is provided.
> NOTE: Salesforce only retains events for 24 hours (standard-volume) or 72 hours (high-volume/CDC), and events outside this window are unrecoverable regardless of fallback mode. * Type: string * Default: all * Importance: medium ### Auto-restart policy `auto.restart.on.user.error` : Enable connector to automatically restart on user-actionable errors.
* Type: boolean * Default: true * Importance: medium ## Frequently asked questions Find answers to frequently asked questions about the Salesforce Platform Event Source connector for Confluent Cloud. ### Authentication and connection #### How do I resolve authentication failures with the error `Check that your Salesforce credentials have access to the resources`? This error indicates the connector cannot authenticate to Salesforce or lacks permissions to access the configured platform events. **Resolution:** 1. Verify your credentials (username, password, security token, consumer key, and consumer secret) are correct and not expired. 2. Confirm you are using the correct Salesforce instance URL (`https://login.salesforce.com` for production or `https://test.salesforce.com` for sandbox environments). 3. Ensure the Salesforce user has the necessary permissions to access platform events and the Streaming API. 4. Verify that your connected app is properly configured in Salesforce with the correct OAuth settings. 5. If using `JWT_BEARER` grant type, confirm your JWT keystore file is valid and the password is correct. 6. After correcting the configuration, save and restart the connector. #### How do I resolve `Could not authenticate to Salesforce` errors? This error typically occurs due to incorrect credentials or an incorrect Salesforce instance URL. **Resolution:** - Test your credentials using the Salesforce CLI to verify they work outside of the connector. - Verify you are connecting to the correct Salesforce instance (production vs. sandbox). - For `CLIENT_CREDENTIALS` grant type (available only in fully managed connectors), verify your OAuth 2.0 configuration is correct. - Update the connector configuration with the correct credentials and restart. #### What authentication methods are supported in the fully managed connector? The fully managed Salesforce Platform Event Source connector supports three authentication methods: * **PASSWORD**: Username and password with security token. * **JWT_BEARER**: JSON Web Token (JWT) authentication using a keystore file. * **CLIENT_CREDENTIALS**: OAuth 2.0 client credentials grant (available only in fully managed connectors). Configure the authentication method using the `salesforce.grant.type` property. The `CLIENT_CREDENTIALS` grant type is not supported in self-managed connectors. ### Data ingestion and ReplayID management #### How do I resolve ReplayID casting errors? If you see errors like `java.lang.ClassCastException: value (a java.lang.String) cannot be cast to expected type ReplayIdWrapper at SalesforceEven.ReplayId`, this indicates a mismatch between the data received from Salesforce and the schema expected by the connector. **Resolution:** 1. Review the connector configuration, especially any custom schema or field mappings related to ReplayID. 2. Verify the data coming from Salesforce for the ReplayID field matches the expected type. 3. Check the [Salesforce documentation on message durability](https://developer.salesforce.com/docs/atlas.en-us.api_streaming.meta/api_streaming/using_streaming_api_durability.htm) to ensure the ReplayID is in the correct format. 4. Review your connector logs for additional details about the schema mismatch. #### Why does the connector show warnings about invalid or unavailable ReplayID? You might see warnings like `The replayID nnnnn was invalid or no longer available`. This warning indicates that the connector is attempting to consume events using a ReplayID that Salesforce no longer recognizes, possibly because the ReplayID is too old or has been purged from Salesforce’s event retention. These are warning messages only and no action is required. The connector automatically resets the ReplayID to ensure it can read all enqueued messages. This is a fallback mechanism when the specified ReplayID is not valid. Salesforce retains standard-volume platform events for approximately 24 hours and high-volume events for approximately 72 hours. Subscribers can only replay events within this retention window. Check with your Salesforce administrator to ensure that the ReplayID is valid and within the retention period. #### Why is the connector not receiving new platform events even though it shows as running? If your connector appears to be in a running state but is not receiving new events from Salesforce, this might be due to a known issue in connector versions prior to 2.0.29. In the logs, you might see: ```text INFO [|task-0] channel[/meta/disconnect] ``` This issue is caused by changes to Salesforce’s reconnection logic in Salesforce version 64.0. **Resolution:** 1. Upgrade to connector version 2.0.29 or later, which includes a fix for handling server disconnect errors in Streaming API-based connectors. 2. As a temporary workaround, restart the connector to allow it to reconnect to Salesforce. Visit the [Salesforce connector changelog](https://docs.confluent.io/kafka-connectors/salesforce/2.0/changelog.html) for more information about version updates. #### How do I manage offsets and control where the connector starts consuming events? The connector maintains a ReplayID offset to track its position in the event stream. You can view and manage offsets using the Confluent Cloud offset management APIs: * Use `GET` requests to retrieve the current ReplayID offset and observe the connector’s position. * Use `PATCH` requests to update the ReplayID offset and control from where consumption resumes after incidents. * Use `DELETE` requests to reset offsets to the base state, as if creating a new connector. Configure the `salesforce.initial.start` property to control where the connector starts consuming: * `LATEST`: Consume only new events published after the connector starts. * `ALL`: Consume all events from the last 72 hours (subject to Salesforce retention limits). You can also configure `invalid.replay.id.behaviour` to control how the connector handles invalid or missing ReplayIDs: * `ALL`: Read data from the beginning when ReplayID is invalid. * `LATEST`: Resume from the latest event when ReplayID is invalid. For detailed information, see [Manage custom offsets](#cc-salesforce-bulk-platform-event-source-custom-offsets). ### Configuration and limits #### How do I configure the connector to consume multiple platform events? The connector supports consuming up to 5 platform events using a Salesforce custom channel. To enable this feature: 1. In Salesforce, create a custom channel and add all relevant platform events as channel entities. The custom channel name must end with `__chn`. 2. In the connector configuration, set `salesforce.platform.subscription.type` to `CUSTOM_CHANNEL`. 3. Provide the custom channel name in `salesforce.platform.eventN.name` (must end with `__chn`). 4. Add a list of the platform events you want to subscribe to. When using `CUSTOM_CHANNEL` subscription type, you can also use `${_ObjectType}` in the topic name to create different topic names based on the event name. This enables automatic topic creation for each event type. Note that the connector enforces a limit of one task per connector (`tasks.max=1`) due to Salesforce limitations on channel subscriptions. #### Why is my topic name being converted to lowercase? By default, the fully managed connector converts topic names to lowercase when `kafka.topic.lowercase` is set to `true` (the default value). If a topic with that lowercase name does not exist, the connector creates a new one. To use topic names with uppercase characters: 1. Set `kafka.topic.lowercase` to `false` in the connector configuration. 2. If you are updating an existing connector via the CLI, API, or Terraform, you must first update the Service Account’s Topic ACL to include the case-sensitive topic name. This configuration allows the connector to support topic names in their original case and prevents mismatches with case-sensitive resources like ACLs. #### What are the platform event naming requirements? Platform event names in Salesforce must follow these requirements: * The platform event name must either be a standard platform event (for example, `SessionHijackingEvent`) or end with `__e` (for example, `TestEvent__e`). * Custom platform events include the `__c` suffix for custom fields. * Platform event names are case-sensitive and must match exactly in the connector configuration. * Custom channel names must end with `__chn`. Ensure the platform event exists in your Salesforce organization and is actively publishing events before configuring the connector. #### How do I resolve `Buffering capacity 1048576 exceeded` errors? This error occurs when the message size from Salesforce exceeds the default maximum message size of 1MB configured in the internal CometD client. **Resolution:** > Reach out to [Confluent Support](https://support.confluent.io/) for increasing the size limit. ### Troubleshooting #### How do I troubleshoot when the connector status is running but not processing data? If the connector status is running but not processing data, follow these troubleshooting steps: 1. **Check connector logs**: Look for authentication errors, disconnect messages (`channel[/meta/disconnect]`), or ReplayID warnings. 2. **Verify platform events are being published**: Confirm that events are actively being published to the platform event in Salesforce. 3. **Check Salesforce API limits**: Verify that your Salesforce organization has not exceeded its daily API event limits. You might see an error like `Organization total events daily limit exceeded`. 4. **Review connector version**: If using a version prior to 2.0.29, upgrade to the latest version to resolve known issues with Salesforce 64.0 reconnection logic. 5. **Verify offset position**: Use the offset management API to check the current ReplayID and ensure the connector is at the expected position. 6. **Test connectivity**: Verify the connector can reach the Salesforce instance URL and authenticate successfully. If issues persist after these checks, restart the connector and monitor the logs for specific error messages. #### Where can I find additional troubleshooting resources? For additional troubleshooting guidance: * Review the connector configuration properties at [Configuration Properties](#cc-salesforce-platform-event-source-config-properties) * Check the offset management section at [Manage custom offsets](#cc-salesforce-bulk-platform-event-source-custom-offsets) * Consult the [Salesforce Streaming API documentation](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/platform_events_intro.htm) for Salesforce-specific issues * Review the connector limitations at [Salesforce Platform Event Source Connector](limits.md#cc-salesforce-platform-event-source-limits) * Contact Confluent Support through the Confluent Cloud Console if you need further assistance ## Next Steps For an example that shows fully managed Confluent Cloud connectors in action with Confluent Cloud for Apache Flink, see the [Cloud ETL Demo](/platform/current/tutorials/examples/cloud-etl/docs/index.html). This example also shows how to use Confluent CLI to manage your resources in Confluent Cloud. [![image](images/topology.png)](https://docs.confluent.io/platform/current/tutorials/examples/cloud-etl/docs/index.html)