Configure Recruitment Cloud For External Client Apps

Salesforce is retiring the older "Connected App" framework for the newer, more secure External Client App (ECA) standard.

To keep your integrations running as expected and comply with Salesforce security best practices, we created a new package for External Client Apps called “BHRC Middleware Integration”.

BHRC Middleware Integration

Prerequisites

  • Access to the BHRC Middleware integration package. Request the package from Bullhorn Support.
  • An admin user account to assign as the Run As User (must have full admin privileges). You will need the username, not the email address.

Configure the Admin User

Assign the admin user the applicable Permission Set, System Permissions, Contact Field Edit Permissions, and App Permissions required for the customer's Middleware Integration as shown in the table below.

Middleware Integration Permission Set System Permissions Contact Field Edit Permissions App Permissions
Nova BH MW Integration - Nova1 Modify All Data, View All Data AccountId, DoNotCall, Email, HasOptedOutOfEmail, HomePhone, MobilePhone None
Charm BH MW Integration - Charm Modify All Data DoNotCall, HasOptedOutOfEmail Content > Query All Files
DIS (Daxtra customers) BH MW Integration - DIS None None None
DMS
(always required)		 BH MW Integration - DMS Modify All Data None None
Candidate Flow (always required) BH MW Integration - Candidate Flow View All Data None None

Install the Package

  1. Copy the installation URL from the BHRC Middleware integration package and open it in your browser while logged in to the target Salesforce org.
  2. Enter the installation password when prompted.
  3. Select Install for Admins Only and click Install.

Configure the External Client App

  1. Go to Setup and type External Client App Manager in the QuickFind box.

  2. Locate BHRC Middleware Integration in the list and click it.

  3. Click Edit.
  4. Navigate to the OAuth Policies section.
  5. In the Plugin Policies section, change the Permitted Users setting from All users can self-authorize to Admin approved users are pre-authorized.
  6. In the OAuth Flows and External Client App Enhancements section, select the Enable Client Credentials Flow checkbox.
  7. In the Run As User field, enter the username (not the email address) of an admin account.

  8. Click Save.

Talent Rover Document Editor

Prerequisites

  • Completed the post-deployment steps for BHRC Middleware integration.
  • Identified all existing permission sets or profiles assigned to users who need access to Talent Rover Document Editor, or created new ones for this purpose.

Configure the External Client App

  1. Go to Setup and type External Client App Manager in the Quick Find box.
  2. Locate Talent Rover Document Editor in the list and click it.
  3. Click Edit.
  4. Change the Permitted Users field from All users can self-authorize to Admin approved users are pre-authorized.
  5. Two new sections appear: Profiles and Permission Sets. Grant access to the relevant users via either:
    • Profiles: Add profiles belonging to user groups who need access to Talent Rover Document Editor.
    • Permission Sets: Add permission sets belonging to user groups who need access to Talent Rover Document Editor.

  6. Click Save.

Packaged permission sets cannot be assigned in Step 5. This is a Salesforce limitation.

Talent Rover Job Board Search

Prerequisites

  • Completed the post-deployment steps for BHRC Middleware integration.
  • Identified all existing permission sets or profiles assigned to users who need access to Talent Rover Job Board Search, or created new ones for this purpose.

Configure the External Client App

  1. Go to Setup and type External Client App Manager in the Quick Find box.
  2. Locate Talent Rover Job Board Search in the list and click it.
  3. Click Edit.
  4. Change the Permitted Users field from All users can self-authorize to Admin approved users are pre-authorized.
  5. Two new sections appear: Profiles and Permission Sets. Grant access to the relevant users via either:
    • Profiles: Add profiles belonging to user groups who need access to Talent Rover Job Board Search.
    • Permission Sets: Add permission sets belonging to user groups who need access to Talent Rover Job Board Search.
  6. Click Save.

Packaged permission sets cannot be assigned in Step 5. This is a Salesforce limitation.

Talent Rover Tooling API

Create the External Client App

  1. In Setup, type External in Quick Find and click External Client App Manager.
  2. Click New External Client App.
  3. Fill in the following fields:
    • External Client App Name: Tooling API JWT
    • API Name: ToolingAPI_JWT
    • Contact Email: admin@talentrover.com
    • Distribution State: Local
  4. Click Save.

Create a Certificate

The certificate is used to securely sign JWT authentication requests to Salesforce.

  1. Click the gear icon and go to Setup.
  2. In Quick Find, type Certificate and click Certificate and Key Management.
  3. Click Create Self-Signed Certificate and fill in the following:
    • Label: Enter any label, for example ToolingAPIJWT.
    • Unique Name: Auto-fills. Note this value exactly; you will need it later.
    • Key Size: Leave as 2048.
    • Exportable Private Key: Leave unchecked.
    • Use Platform Encryption: Leave unchecked.
  4. Click Save.
  5. Click Download Certificate. This saves a .crt file. Keep this file; you will need it in the next procedure, Configure the Tooling API App.

Configure the Tooling API App

The ECA package installs an app called Tooling API JWT. Configure its OAuth settings and register your certificate with it.

  1. In Setup, type External in Quick Find and click External Client App Manager.
  2. Find Tooling API JWT, click the dropdown arrow, and select Edit Settings.
  3. Under OAuth Settings, expand the section if it is not already open.
  4. In the Callback URL field, enter: https://oauth.salesforce.com/token
  5. In Selected OAuth Scopes, add both of the following:
    • Manage user data via APIs (api)
    • Perform requests at any time (refresh_token, offline_access)
  6. In Flow Enablement, select the Enable JWT Bearer Flow checkbox and upload the .crt file downloaded in the previous procedure, Create a Certificate.
  7. In Security, select all four checkboxes:
    • Require secret for Web Server Flow
    • Require secret for Refresh Token Flow
    • Require Proof Key for Code Exchange (PKCE)
    • Limit Idle Refresh Token Time-to-Live (TTL) to 30 Days
  8. Click Save.

Set the Authorization Policy

  1. In External Client App Manager, find Tooling API JWT, click the dropdown, and select Edit Policies.
  2. Set Permitted Users to Admin approved users are pre-authorized.
  3. Under App Policies > Permission Sets, click Add and add the permission sets assigned to users who need the GenericBrowse Related List tab.
  4. Click Save.

Copy the Consumer Key

  1. In External Client App Manager, click the name of Tooling API JWT directly (not the dropdown arrow).
  2. Go to Settings > OAuth Settings.
  3. Click Consumer Key and Secret and enter the verification code sent to your email.
  4. Copy the Consumer Key. You will need it in the next procedure, Create an External Credential.

If you cannot see the Consumer Key/Secret after verification, grant your user the following permissions: View all External Client Apps, and View all External Client Apps, view their settings, and edit their policies.

Create an External Credential

The External Credential wires the Named Credential to the ECA using the OAuth 2.0 JWT Bearer flow. Salesforce signs a JWT with your certificate, exchanges it for an OAuth access token at your org's token endpoint, and automatically injects the Authorization header on Tooling API callouts.

  1. In Setup, type Named Credentials in Quick Find and click Named Credentials.
  2. Switch to the External Credentials tab and click New.
  3. Fill in the following:
    • Label: Tooling API JWT
    • Name: ToolingAPIJWT
    • Authentication Protocol: OAuth 2.0
    • Authentication Flow Type: JWT Bearer Flow
    • Identity Provider URL: https://<your-org-domain>/services/oauth2/token — replace with your org's My Domain URL. This must be the org's own token endpoint, not login.salesforce.com.
    • JWT Signing Certificate: Select the certificate created in the previous procedure, Create a Certificate.
    • Issuer (iss): Paste the Consumer Key copied in the previous procedure, Copy the Consumer Key.
    • Subject (sub): {!$User.UserName}
    • Audience (aud): https://<your-org-domain> — your org's My Domain URL without the /services/oauth2/token suffix. Must match the Identity Provider URL host.
    • Scope: Leave blank.
  4. Click Save.

Create a Principal

  1. On the saved External Credential detail page, scroll to the Principals section and click New.
  2. Fill in the following:
    • Parameter Name: ToolingAPIJWTPrincipal
    • Identity Type: Named Principal
    • Sequence Number: 1
  3. Click Save.

Set External Credential Principal Access for Users

  1. Go to Setup > Permission Sets.
  2. Open the permission set assigned to users who need the Related List tab.
  3. Click External Credential Principal Access in the Apps section.
  4. Click Edit and move ToolingAPIJWT - ToolingAPIJWTPrincipal to the Enabled column.
  5. Click Save.

Create the Named Credential

The Name field must be exactly ToolingAPIJWT (case-sensitive). A mismatch here is the most common cause of related lists not loading.

  1. On the Named Credentials page, switch to the Named Credentials tab and click New.
  2. Fill in the following:
    • Label: Tooling API JWT
    • Name: ToolingAPIJWT — must match exactly
    • URL: Your org's My Domain URL, for example https://myorg.my.salesforce.com
    • External Credential: Select Tooling API JWT
    • Callout Options: Select all three checkboxes: Generate Authorization Header, Allow Formulas in HTTP Header, Allow Formulas in HTTP Body
    • Managed Package Access > Allowed Namespaces: TR1
  3. Click Save.

Verify It Works

  1. Navigate to a Job record with at least one application.
  2. Go to the ATS (not Omnitable).
  3. Click the i icon to the right of the application to open the popup.
  4. Click the Related tab. The related lists should load correctly.

If the related lists do not load, verify the following:

  • The Named Credential Name is exactly ToolingAPIJWT (case-sensitive).
  • The Named Credential URL is your org's My Domain URL, not the full Tooling API path.
  • The Identity Provider URL in the External Credential is https://<your-org-domain>/services/oauth2/token, not login.salesforce.com.
  • The Audience (aud) claim matches the org's My Domain URL with no trailing slash and no lightning/setup path.
  • The External Credential JWT Signing Certificate matches the certificate uploaded to the ECA.
  • The Issuer (iss) in the External Credential matches the Consumer Key copied from the ECA in Copy the Consumer Key.
  • The permission set from Set the Authorization Policy is assigned to your user.
  • The Allowed Namespaces field on the Named Credential contains TR1.

Talent Rover UI API

Create the External Client App

  1. In Setup, type External in Quick Find and click External Client App Manager.
  2. Click New External Client App.
  3. Fill in the following:
    • External Client App Name: UI API App
    • API Name: UI_API_App
    • Contact Email: Your admin email address
    • Distribution State: Local
  4. Click Create.

Configure the UI API App

  1. Click the dropdown and select Edit Settings.
  2. Under OAuth Settings, expand the section if it is not already open.
  3. Select the Enable OAuth checkbox.
  4. In the Callback URL field, enter your org's My Domain URL followed by the auth callback path: https://<your-org-domain>/services/authcallback/UI_API_Auth
  5. In Selected OAuth Scopes, add:
    • Manage user data via APIs (api)
    • Manage user data via Web browser (web)
    • Perform requests at any time (refresh_token, offline_access)
  6. In Security, select all four checkboxes:
    • Require Secret for Web Server Flow
    • Require Secret for Refresh Token Flow
    • Require Proof Key for Code Exchange (PKCE)
    • Limit Idle Refresh Token Time-to-Live (TTL) to 30 Days
  7. Click Save.

The URL suffix UI_API_Auth is case-sensitive and must match the Auth Provider URL Suffix you create later exactly.

Set the Authorization Policy

  1. In External Client App Manager, find UI API App, click the dropdown, and select Edit Policies.
  2. Set Permitted Users to Admin approved users are pre-authorized.
  3. Under App Policies > Permission Sets, click Add and add the permission sets assigned to users who need UI API functionality.
  4. Click Save.

Copy the Consumer Key and Secret

  1. In External Client App Manager, click the name of UI API App directly (not the dropdown arrow).
  2. Go to Settings > OAuth Settings.
  3. Click Consumer Key and Secret and enter the verification code sent to your email.
  4. Copy both the Consumer Key and Consumer Secret. Both are needed in the next procedure, Create an Auth Provider.

If you cannot see the Consumer Key/Secret after verification, grant your user the following permissions: View all External Client Apps, and View all External Client Apps, view their settings, and edit their policies.

Wait approximately 10 minutes before proceeding. Salesforce takes up to 10 minutes to fully propagate a new ECA's OAuth configuration. Creating the Auth Provider before this window expires may cause authentication errors.

Create an Auth Provider

The Auth Provider facilitates the OAuth 2.0 Browser Flow between the Named Credential and the UI API App ECA, using the Consumer Key and Secret to establish trust.

  1. In Setup, type Auth Providers in Quick Find and click Auth Providers.
  2. Click New and fill in the following:
    • Provider Type: Salesforce
    • Name: UI API Auth
    • URL Suffix: UI_API_Auth — must match the callback URL suffix from the ECA configuration exactly (case-sensitive)
    • Consumer Key: Paste the Consumer Key copied in the previous procedure.
    • Consumer Secret: Paste the Consumer Secret copied in the previous procedure.
    • Default Scopes: api web refresh_token offline_access
    • Include Consumer Secret in Soap API Responses: checked
    • Use Proof Key for Code Exchange (PKCE) Extension: checked
  3. Click Save.
  4. After saving, open the Auth Provider detail page and verify the auto-generated Callback URL matches the Callback URL entered on the ECA in Configure the UI API App.

Create an External Credential

The External Credential wires the Named Credential to the ECA using the OAuth 2.0 Browser Flow. The running user authenticates interactively once, and Salesforce manages token refresh automatically.

  1. In Setup, type Named Credentials in Quick Find and click Named Credentials.
  2. Switch to the External Credentials tab and click New.
  3. Fill in the following:
    • Label: UI API Creds
    • Name: UI_API_Creds
    • Authentication Protocol: OAuth 2.0
    • Authentication Flow Type: Browser Flow
    • Scope: api web refresh_token offline_access
    • Identity Provider: Select Auth Provider > UI API Auth (created in Create an Auth Provider)
  4. Click Save.

Create a Principal and Authenticate

  1. On the saved External Credential detail page, scroll to Principals and click New.
  2. Fill in the following:
    • Parameter Name: UI_API_User
    • Identity Type: Named Principal
    • Scope: api web refresh_token offline_access
  3. Click Save.
  4. On the External Credential detail page, find the principal you just created and click Authenticate from its dropdown.
  5. Log in with the user on whose behalf API callouts should run. That user must have:
    • API Enabled
    • Modify Metadata Through Metadata API Functions, or Modify All Data
  6. Click Allow. The principal status changes to Authenticated or Configured.

Set External Credential Principal Access for Users

  1. Go to Setup > Permission Sets.
  2. Open the permission set assigned to users who need UI API functionality.
  3. Click External Credential Principal Access in the Apps section.
  4. Click Edit and move UI_API_Creds - UI_API_User to the Enabled column.
  5. Click Save.

Create the Named Credential

The Name field must be exactly UI_API_Creds (case-sensitive).

  1. On the Named Credentials page, switch to the Named Credentials tab and click New.
  2. Fill in the following:
    • Label: UI API Creds
    • Name: UI_API_Creds — must match exactly
    • URL: Your org's My Domain URL, for example https://myorg.my.salesforce.com
    • External Credential: Select UI API Creds (created in Create an External Credential)
    • Callout Options: Select all three checkboxes: Generate Authorization Header, Allow Formulas in HTTP Header, Allow Formulas in HTTP Body
    • Managed Package Access > Allowed Namespaces: TR1
  3. Click Save.

Verify It Works

Create a new classic Power Note. This action will fail if the configuration is incorrect.

This API callout only triggers when the Power Notes Subject has a picklist field.

If callouts fail, verify the following:

  • The Named Credential Name is exactly UI_API_Creds (case-sensitive).
  • The Named Credential URL is the org's My Domain URL with no lightning/setup path and no trailing slash.
  • The Auth Provider URL Suffix (UI_API_Auth) matches the callback URL suffix in the ECA OAuth settings exactly (case-sensitive).
  • The Auth Provider Callback URL matches the Callback URL set on the ECA in Configure the UI API App.
  • The Principal in the External Credential shows status Authenticated or Configured.
  • The authenticated user has API Enabled and the required Metadata API permission.
  • The Allowed Namespaces field on the Named Credential contains TR1.
  • The Consumer Key and Secret in the Auth Provider match those of the UI API App ECA. If they were recently rotated, repeat the steps to Copy the Consumer Key and Secret and Create an Auth Provider.
  • At least 10 minutes elapsed between ECA creation and Auth Provider setup.