Security Question

[Rodrigo Zurek]

Hey Scott

This might not be an illuminate Cloud issue but would love some insight if you have, I recently received this email on all the accounts I was connected using illuminate cloud:


As a consultant this blocked the accounts of all my clients. I was wondering if you ever encountered an issue like this and if there is anything I could do to avoid it.

I think this was caused by a false positive security issue on one account and trickled to all accounts I was connected via SFDX

Is there a way to segment projects on different SFDX instances? 

Thanks!
Rod

[Scott]

Hi, Rod. I apologize but I'm not sure I understand the issue. It sounds like these are all CLI-managed connections, correct? If so, and if there's an issue with re-establishing them, that would be more of a question for Salesforce since all of that is managed by the Salesforce CLI.

Please let me know if I've misunderstood the issue and question, though.

Regards,

Scott Wells

[Rodrigo Zurek]

Hey Scott

Yeah sorry it was a weird question, just a kick in the bucket. it looks like the issue is around VPN use and Oauth tokens, someone had the exact issue here: https://www.reddit.com/r/SalesforceDeveloper/comments/1pcqqg5/comment/ns9nall/

A more direct question would be if IC2 refreshes tokens automatically at some point? or only when I click on the connection itself?

Maybe if IC2 prompted a full token refresh it could have flagged all my connected orgs, I think i saw a setting that I disabled and maybe that will help (When the cached connection list appears stale: Do Nothing)

Thanks anyways!
Rod

[Scott]

IC itself doesn’t refresh tokens, but if it seems an invalid session ID response to an API call against a CLI-managed OAuth connection, it will execute sf org display on that connection to force a refresh. The option that you found is more around the entire list rather than an individual connection if the cached CLI-managed connection list information seems out-of-date relative to the contents of ~/.sfdx. There’s not a way to disable that for specific connections because if IC is told by the API that the access token is stale, it must attempt to refresh it to do anything further with that connection.

I don’t know if that helps or not. Please let me know if I can provide more information.

Regards,
Scott Wells

​