Salesforce IAM

Details

ID	`Salesforce IAM`
Provider	Salesforce
Category	Identity and Access Management
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Note: This integration should be used along with our IAM premium pack. For further details, visit our IAM pack documentation.

Integrate with Salesforce’s services to perform Identity Lifecycle Management operations.
For more information, please refer to the Identity Lifecycle Management article.

Configure Salesforce IAM in Cortex

Required Fields in Create User Command

When creating a user in Salesforce there are mandatory fields that need to be set. Some of them are set with default values in the integration parameters:
Default Local Sid Key, Default Email Encoding Key and Default Language Locale Key.
ProfileId and Timezone Sid Key are also required, but are filled using the Salesforce mapper in the following manner:
Duplicate the GenerateProfileId and the GenerateTimeZone automations, edit them according to your needs, and use them as transformers in the User Profile - Salesforce (Outgoing) mapper under the ProfileId and TimeZoneSidKey fields respectively.
This configuration ensures that the user being created is created with the right permissions and settings in Salesforce.

Parameter	Description	Required
Salesforce url (Eg: https://domain.salesforce.com/)		True
User name		True
Password		True
Consumer Key		False
Consumer Secret		False
Trust any certificate (not secure)		False
Use system proxy settings		False
Allow creating users		False
Allow updating users		False
Allow enabling users		False
Allow disabling users		False
Automatically create user if not found in update and enable commands		False
Incoming Mapper		True
Outgoing Mapper	Cortex XSOAR only parameter.	False
Default Local Sid Key	Used when creating a new user.	True
Default Email Encoding Key	Used when creating a new user.	True
Default Language Locale Key	Used when creating a new user.	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

iam-create-user

Creates a user with specific settings and permissions in Salesforce, according to the configuration of the Salesforce integration and mapper - as explained in the “Required Fields in Create User Command” section.

Base Command

iam-create-user

Input

Argument Name	Description	Required
user-profile	User Profile indicator details.	Required
allow-enable	When set to true, after the command execution the status of the user in the 3rd-party integration will be active. Possible values are: true, false. Default is true.	Optional

Context Output

Path	Type	Description
IAM.Vendor.active	Boolean	If true the employee’s status is active, otherwise false.
IAM.Vendor.brand	String	Name of the integration.
IAM.Vendor.details	string	Gives the user information if the API was successful, otherwise error information.
IAM.Vendor.email	String	The employee’s email address.
IAM.Vendor.errorCode	Number	HTTP error response code.
IAM.Vendor.errorMessage	String	Reason why the API failed.
IAM.Vendor.id	String	The employee’s user ID in the app.
IAM.Vendor.instanceName	string	Name of the integration instance.
IAM.Vendor.success	Boolean	If true, the command was executed successfully, otherwise false.
IAM.Vendor.username	String	The employee’s username in the app.

Command Example

!iam-create-user user-profile=`{"email":"testdemisto2@paloaltonetworks.com", "givenname":"Test","surname":"Demisto”,”timezonesidkey": "Asia/Tokyo",“localesidkey": "en_US",“profileid": “012345678912345”}`

Human Readable Output

brand	instanceName	success	active	id	email	details
Salesforce IAM	Salesforce IAM_instance_1	true	true	edab746f1b142410042611b4bd4bcb23	testdemisto2@paloaltonetworks.com

iam-update-user

Updates an existing user with the data passed in the user-profile argument.

Base Command

iam-update-user

Input

Argument Name	Description	Required
user-profile	A User Profile indicator.	Required
allow-enable	When set to true, after the command execution the status of the user in the 3rd-party integration will be active. Possible values are: true, false. Default is true.	Optional

Context Output

Path	Type	Description
IAM.Vendor.active	Boolean	If true the employee’s status is active, otherwise false.
IAM.Vendor.brand	String	Name of the integration.
IAM.Vendor.details	string	Gives the user information if the API was successful, otherwise error information.
IAM.Vendor.email	String	The employee’s email address.
IAM.Vendor.errorCode	Number	HTTP error response code.
IAM.Vendor.errorMessage	String	Reason why the API failed.
IAM.Vendor.id	String	The employee’s user ID in the app.
IAM.Vendor.instanceName	string	Name of the integration instance.
IAM.Vendor.success	Boolean	If true, the command was executed successfully, otherwise false.
IAM.Vendor.username	String	The employee’s username in the app.

Command Example

!iam-update-user user-profile=`{"email":"testdemisto2@paloaltonetworks.com", "givenname":"Test","surname":"Demisto_updated"}`

Human Readable Output

brand	instanceName	success	active	id	email	details
Salesforce IAM	Salesforce IAM_instance_1	true	true	edab746f1b142410042611b4bd4bcb23	testdemisto2@paloaltonetworks.com

iam-get-user

Retrieves a single user resource.

Base Command

iam-get-user

Input

Argument Name	Description	Required
user-profile	A User Profile indicator.	Required

Context Output

Path	Type	Description
IAM.Vendor.active	Boolean	If true the employee’s status is active, otherwise false.
IAM.Vendor.brand	String	Name of the integration.
IAM.Vendor.details	string	Gives the user information if the API was successful, otherwise error information.
IAM.Vendor.email	String	The employee’s email address.
IAM.Vendor.errorCode	Number	HTTP error response code.
IAM.Vendor.errorMessage	String	Reason why the API failed.
IAM.Vendor.id	String	The employee’s user ID in the app.
IAM.Vendor.instanceName	string	Name of the integration instance.
IAM.Vendor.success	Boolean	If true, the command was executed successfully, otherwise false.
IAM.Vendor.username	String	The employee’s username in the app.

Command Example

!iam-get-user user-profile=`{"email":"testdemisto2@paloaltonetworks.com"}`

Human Readable Output

brand	instanceName	success	active	id	email	details
Salesforce IAM	Salesforce IAM_instance_1	true	true	edab746f1b142410042611b4bd4bcb23	testdemisto2@paloaltonetworks.com	“AboutMe”: null, “AccountId”: null, “Address”: null, “Alias”: “testdemi”, “BadgeText”: “”, “BannerPhotoUrl”: “/profilephoto/”, “CallCenterId”: null, “City”: null, “CommunityNickname”: “User1”, “CompanyName”: null, “ContactId”: null, “Country”: null, “CreatedById”: “123”, “CreatedDate”: “2020-12-29T09:07:00.000+0000”, “DefaultGroupNotificationFrequency”: “N”, “DelegatedApproverId”: null, “Department”: null, “DigestFrequency”: “D”, “Division”: null, “Email”: “testdemisto2@paloaltonetworks.com”, “EmailEncodingKey”: “ISO-8859-1”, “EmailPreferencesAutoBcc”: true, “EmailPreferencesAutoBccStayInTouch”: false, “EmailPreferencesStayInTouchReminder”: true, “EmployeeNumber”: null, “Extension”: null, “Fax”: null, “FederationIdentifier”: null, “FirstName”: “test”, “ForecastEnabled”: false, “FullPhotoUrl”: “https://profilephoto/”, “GeocodeAccuracy”: null, “Id”: “123”, “IndividualId”: null, “IsActive”: true, “IsExtIndicatorVisible”: false, “IsProfilePhotoActive”: false, “JigsawImportLimitOverride”: null, “LanguageLocaleKey”: “en_US”, “LastLoginDate”: null, “LastModifiedById”: “0054K000001WwcuQAC”, “LastModifiedDate”: “2021-01-03T13:53:24.000+0000”,”LastName”: “test2”, “LastPasswordChangeDate”: null, “LastReferencedDate”: “2021-01-03T14:14:00.000+0000”, “LastViewedDate”: “2021-01-03T14:14:00.000+0000”, “Latitude”: null, “LocaleSidKey”: “en_US”, “Longitude”: null, “ManagerId”: null, “MediumBannerPhotoUrl”: “/profilephoto/”, “MediumPhotoUrl”: “https:/profilephoto/”, “MobilePhone”: null, “Name”: “test”, “OfflinePdaTrialExpirationDate”: null, “OfflineTrialExpirationDate”: null, “OutOfOfficeMessage”: “”, “Phone”: null, “PostalCode”: null, “ProfileId”: “012345678912345”, “ReceivesAdminInfoEmails”: false, “ReceivesInfoEmails”: false, “SenderEmail”: null, “SenderName”: null, “Signature”: null, “SmallBannerPhotoUrl”: “/profilephoto/”, “SmallPhotoUrl”: “profilephoto”, “State”: null, “StayInTouchNote”: null, “StayInTouchSignature”: null, “StayInTouchSubject”: null, “Street”: null, “SystemModstamp”: “2021-01-03T13:53:24.000+0000”, “TimeZoneSidKey”: “Asia/Tokyo”, “Title”: null, “UserPermissionsCallCenterAutoLogin”: false, “UserPermissionsInteractionUser”: false, “UserPermissionsJigsawProspectingUser”: false, “UserPermissionsKnowledgeUser”: false, “UserPermissionsMarketingUser”: false, “UserPermissionsMobileUser”: false, “UserPermissionsOfflineUser”: false, “UserPermissionsSFContentUser”: true, “UserPermissionsSiteforceContributorUser”: false, “UserPermissionsSiteforcePublisherUser”: false, “UserPermissionsSupportUser”: false, “UserPermissionsWorkDotComUserFeature”: false, “UserPreferencesActivityRemindersPopup”: true, “UserPreferencesApexPagesDeveloperMode”: false, “UserPreferencesCacheDiagnostics”: false, “UserPreferencesContentEmailAsAndWhen”: false, “UserPreferencesContentNoEmail”: false, “UserPreferencesCreateLEXAppsWTShown”: false, “UserPreferencesDisCommentAfterLikeEmail”: false, “UserPreferencesDisMentionsCommentEmail”: false, “UserPreferencesDisProfPostCommentEmail”: false, “UserPreferencesDisableAllFeedsEmail”: false, “UserPreferencesDisableBookmarkEmail”: false, “UserPreferencesDisableChangeCommentEmail”: false, “UserPreferencesDisableEndorsementEmail”: false, “UserPreferencesDisableFeedbackEmail”: false, “UserPreferencesDisableFileShareNotificationsForApi”: false, “UserPreferencesDisableFollowersEmail”: false, “UserPreferencesDisableLaterCommentEmail”: false, “UserPreferencesDisableLikeEmail”: true, “UserPreferencesDisableMentionsPostEmail”: false, “UserPreferencesDisableMessageEmail”: false, “UserPreferencesDisableProfilePostEmail”: false, “UserPreferencesDisableSharePostEmail”: false, “UserPreferencesDisableWorkEmail”: false, “UserPreferencesEnableAutoSubForFeeds”: false, “UserPreferencesEventRemindersCheckboxDefault”: true, “UserPreferencesExcludeMailAppAttachments”: false, “UserPreferencesFavoritesShowTopFavorites”: false, “UserPreferencesFavoritesWTShown”: false, “UserPreferencesGlobalNavBarWTShown”: false, “UserPreferencesGlobalNavGridMenuWTShown”: false, “UserPreferencesHasCelebrationBadge”: false, “UserPreferencesHideBiggerPhotoCallout”: false, “UserPreferencesHideCSNDesktopTask”: false, “UserPreferencesHideCSNGetChatterMobileTask”: false, “UserPreferencesHideChatterOnboardingSplash”: false, “UserPreferencesHideEndUserOnboardingAssistantModal”: false, “UserPreferencesHideLightningMigrationModal”: false, “UserPreferencesHideS1BrowserUI”: false, “UserPreferencesHideSecondChatterOnboardingSplash”: false, “UserPreferencesHideSfxWelcomeMat”: true, “UserPreferencesJigsawListUser”: false, “UserPreferencesLightningExperiencePreferred”: true, “UserPreferencesNewLightningReportRunPageEnabled”: false, “UserPreferencesPathAssistantCollapsed”: false, “UserPreferencesPipelineViewHideHelpPopover”: false, “UserPreferencesPreviewCustomTheme”: false, “UserPreferencesPreviewLightning”: false, “UserPreferencesRecordHomeReservedWTShown”: false, “UserPreferencesRecordHomeSectionCollapseWTShown”: false, “UserPreferencesReminderSoundOff”: false, “UserPreferencesShowCityToExternalUsers”: false, “UserPreferencesShowCityToGuestUsers”: false, “UserPreferencesShowCountryToExternalUsers”: false, “UserPreferencesShowCountryToGuestUsers”: false, “UserPreferencesShowEmailToExternalUsers”: false, “UserPreferencesShowEmailToGuestUsers”: false, “UserPreferencesShowFaxToExternalUsers”: false, “UserPreferencesShowFaxToGuestUsers”: false, “UserPreferencesShowManagerToExternalUsers”: false, “UserPreferencesShowManagerToGuestUsers”: false, “UserPreferencesShowMobilePhoneToExternalUsers”: false, “UserPreferencesShowMobilePhoneToGuestUsers”: false, “UserPreferencesShowPostalCodeToExternalUsers”: false, “UserPreferencesShowPostalCodeToGuestUsers”: false, “UserPreferencesShowProfilePicToGuestUsers”: false, “UserPreferencesShowStateToExternalUsers”: false, “UserPreferencesShowStateToGuestUsers”: false, “UserPreferencesShowStreetAddressToExternalUsers”: false, “UserPreferencesShowStreetAddressToGuestUsers”: false, “UserPreferencesShowTitleToExternalUsers”: true, “UserPreferencesShowTitleToGuestUsers”: false, “UserPreferencesShowWorkPhoneToExternalUsers”: false, “UserPreferencesShowWorkPhoneToGuestUsers”: false, “UserPreferencesSortFeedByComment”: true, “UserPreferencesSuppressEventSFXReminders”: false, “UserPreferencesSuppressTaskSFXReminders”: false, “UserPreferencesTaskRemindersCheckboxDefault”: true, “UserPreferencesUserDebugModePref”: false, “UserRoleId”: null, “UserType”: “Standard”, “Username”: “testdemisto2@paloaltonetworks.com”,

iam-disable-user

Disable an active user.

Base Command

iam-disable-user

Input

Argument Name	Description	Required
user-profile	A User Profile indicator.	Required

Context Output

Path	Type	Description
IAM.Vendor.active	Boolean	If true the employee’s status is active, otherwise false.
IAM.Vendor.brand	String	Name of the integration.
IAM.Vendor.details	string	Gives the user information if the API was successful, otherwise error information.
IAM.Vendor.email	String	The employee’s email address.
IAM.Vendor.errorCode	Number	HTTP error response code.
IAM.Vendor.errorMessage	String	Reason why the API failed.
IAM.Vendor.id	String	The employee’s user ID in the app.
IAM.Vendor.instanceName	string	Name of the integration instance.
IAM.Vendor.success	Boolean	If true, the command was executed successfully, otherwise false.
IAM.Vendor.username	String	The employee’s username in the app.

Command Example

!iam-disable-user user-profile=`{"email":"testdemisto2@paloaltonetworks.com"}`

Human Readable Output

brand	instanceName	success	active	id	email	details
Salesforce IAM	Salesforce IAM_instance_1	true	false	edab746f1b142410042611b4bd4bcb23	testdemisto2@paloaltonetworks.com

get-mapping-fields

Retrieves a User Profile schema which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.

Base Command

get-mapping-fields

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Configuration parameters

url — Salesforce url (Eg: https://<domain>.salesforce.com/) (required)
credentials — User name (required)
consumer_key — Consumer Key
consumer_secret — Consumer Secret
credentials_consumer — Consumer Key
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
create_user_enabled — Allow creating users
update_user_enabled — Allow updating users
enable_user_enabled — Allow enabling users
disable_user_enabled — Allow disabling users
create_if_not_exists — Automatically create user if not found in update and enable commands
mapper_in — Incoming Mapper (required)
mapper_out — Outgoing Mapper
localesidkey — Default Local Sid Key (required)
emailencodingkey — Default Email Encoding Key (required)
languagelocalekey — Default Language Locale Key (required)

Commands (5)

get-mapping-fields
Retrieves a User Profile schema which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.
iam-create-user
Creates a user.
iam-disable-user
Disable an active user.
iam-get-user
Retrieves a single user resource.
iam-update-user
Updates an existing user with the data passed in the user-profile argument.

Source

Salesforce_IAM.py Salesforce_IAM_test.py Salesforce_IAM.yml Salesforce_IAM_description.md

Download History Raw

import pytest
import demistomock as demisto
from IAMApiModule import *
from Salesforce_IAM import Client, IAMUserProfile, create_user_command, get_user_command, update_user_command


def mock_client():
    client = Client(
        demisto_params={},
        base_url="base_url",
        conn_client_id="client_id",
        conn_client_secret="client_secret",
        conn_username="",
        conn_password="password",
        ok_codes=(200, 201, 204),
        verify=True,
        proxy=True,
    )

    return client


create_inp_schme = {
    "username": "test@palo.com",
    "Email": "test@palo.com",
    "LastName": "haim",
    "FirstName": "test",
    "Alias": "a",
    "TimeZoneSidKey": "Asia/Tokyo",
    "LocaleSidKey": "en_US",
    "EmailEncodingKey": "ISO-8859-1",
    "ProfileId": "00e4K000001GgCL",
    "LanguageLocaleKey": "en_US",
}

demisto.callingContext = {"context": {"IntegrationInstance": "Test", "IntegrationBrand": "Test"}}

SALESFORCE_GET_USER_OUTPUT = {
    "Email": "TestID@networks.com",
    "Username": "TestID@networks.com",
    "FirstName": "test",
    "Id": "12345",
    "IsActive": "true",
}


SALESFORCE_CREATE_USER_OUTPUT = {"id": "12345", "success": True}


def get_outputs_from_user_profile(user_profile):
    entry_context = user_profile.to_entry()
    outputs = entry_context.get("Contents")

    return outputs


def test_create_user_command(mocker):
    args = {"user-profile": {"email": "mock@mock.com"}}
    mocker.patch.object(Client, "get_access_token_", return_value="")
    client = mock_client()

    mocker.patch.object(IAMUserProfile, "map_object", return_value={})
    mocker.patch.object(client, "create_user", return_value=SALESFORCE_CREATE_USER_OUTPUT)
    mocker.patch.object(client, "get_user_id_and_activity_by_mail", return_value=(None, None))

    iam_user_profile = create_user_command(client, args, "mapper_out", True, True, True)
    outputs = get_outputs_from_user_profile(iam_user_profile)

    assert outputs.get("action") == IAMActions.CREATE_USER
    assert outputs.get("success") is True
    assert outputs.get("active") is True
    assert outputs.get("id") == "12345"


def test_get_user_command__existing_user(mocker):
    args = {"user-profile": {"email": "mock@mock.com"}}
    mocker.patch.object(Client, "get_access_token_", return_value="")
    client = mock_client()

    mocker.patch.object(client, "get_user", return_value=SALESFORCE_GET_USER_OUTPUT)
    mocker.patch.object(client, "get_user_id_and_activity_by_mail", return_value=("id", None))
    mocker.patch.object(IAMUserProfile, "update_with_app_data", return_value={})

    iam_user_profile = get_user_command(client, args, "mapper_in", "mapper_out")
    outputs = get_outputs_from_user_profile(iam_user_profile)

    assert outputs.get("action") == IAMActions.GET_USER
    assert outputs.get("success") is True
    assert outputs.get("active") is True
    assert outputs.get("id") == "12345"
    assert outputs.get("username") == "TestID@networks.com"


def test_get_user_command__non_existing_user(mocker):
    args = {"user-profile": {"email": "mock@mock.com"}}
    mocker.patch.object(Client, "get_access_token_", return_value="")
    client = mock_client()

    mocker.patch.object(client, "get_user_id_and_activity_by_mail", return_value=(None, None))
    mocker.patch.object(client, "get_user", return_value={})

    iam_user_profile = get_user_command(client, args, "mapper_in", "mapper_out")
    outputs = get_outputs_from_user_profile(iam_user_profile)

    assert outputs.get("action") == IAMActions.GET_USER
    assert outputs.get("success") is False
    assert outputs.get("errorCode") == IAMErrors.USER_DOES_NOT_EXIST[0]
    assert outputs.get("errorMessage") == IAMErrors.USER_DOES_NOT_EXIST[1]


def test_create_user_command__user_already_exists(mocker):
    args = {"user-profile": {"email": "mock@mock.com"}}
    mocker.patch.object(Client, "get_access_token_", return_value="")
    client = mock_client()

    mocker.patch.object(client, "get_user_id_and_activity_by_mail", return_value=("mock@mock.com", ""))
    mocker.patch.object(client, "update_user", return_value="")

    iam_user_profile = create_user_command(client, args, "mapper_out", True, True, True)
    outputs = get_outputs_from_user_profile(iam_user_profile)

    assert outputs.get("action") == IAMActions.UPDATE_USER
    assert outputs.get("success") is True


def test_update_user_command__non_existing_user(mocker):
    args = {"user-profile": {"email": "mock@mock.com"}}
    mocker.patch.object(Client, "get_access_token_", return_value="")
    client = mock_client()

    mocker.patch.object(client, "get_user_id_and_activity_by_mail", return_value=(None, None))
    mocker.patch.object(IAMUserProfile, "map_object", return_value={})
    mocker.patch.object(client, "create_user", return_value=SALESFORCE_CREATE_USER_OUTPUT)

    iam_user_profile = update_user_command(
        client,
        args,
        "mapper_out",
        is_command_enabled=True,
        is_enable_enabled=True,
        is_create_user_enabled=True,
        create_if_not_exists=True,
    )
    outputs = get_outputs_from_user_profile(iam_user_profile)

    assert outputs.get("action") == IAMActions.CREATE_USER
    assert outputs.get("success") is True
    assert outputs.get("active") is True
    assert outputs.get("id") == "12345"


def test_update_user_command__command_is_disabled(mocker):
    args = {"user-profile": {"email": "mock@mock.com"}}
    mocker.patch.object(Client, "get_access_token_", return_value="")
    client = mock_client()

    mocker.patch.object(client, "get_user_id_and_activity_by_mail", return_value=(None, None))
    mocker.patch.object(IAMUserProfile, "map_object", return_value={})
    mocker.patch.object(client, "update_user")

    user_profile = update_user_command(
        client,
        args,
        "mapper_out",
        is_command_enabled=False,
        is_enable_enabled=False,
        is_create_user_enabled=False,
        create_if_not_exists=False,
    )
    outputs = get_outputs_from_user_profile(user_profile)

    assert outputs.get("action") == IAMActions.UPDATE_USER
    assert outputs.get("success") is True
    assert outputs.get("skipped") is True
    assert outputs.get("reason") == "Command is disabled."


# ===================== UCP Tests =====================


def test_client_init_skips_token_when_ucp_enabled(mocker):
    """When UCP auth is enabled, Client.__init__ should NOT call get_access_token_
    and self.token should remain None."""
    mocker.patch("Salesforce_IAM.should_use_ucp_auth", return_value=True)
    spy = mocker.patch.object(Client, "get_access_token_", return_value="fake_token")

    client = Client(
        demisto_params={},
        base_url="base_url",
        conn_client_id="",
        conn_client_secret="",
        conn_username="",
        conn_password="",
        ok_codes=(200, 201, 204),
        verify=True,
        proxy=True,
    )

    spy.assert_not_called()
    assert client.token is None


def test_client_init_gets_token_when_ucp_disabled(mocker):
    """When UCP auth is disabled (default), Client.__init__ should call get_access_token_
    and self.token should have the returned value."""
    mocker.patch("Salesforce_IAM.should_use_ucp_auth", return_value=False)
    mocker.patch.object(Client, "get_access_token_", return_value="my_token")

    client = Client(
        demisto_params={},
        base_url="base_url",
        conn_client_id="client_id",
        conn_client_secret="client_secret",
        conn_username="user",
        conn_password="password",
        ok_codes=(200, 201, 204),
        verify=True,
        proxy=True,
    )

    Client.get_access_token_.assert_called_once()
    assert client.token == "my_token"


def test_main_skips_credential_extraction_when_ucp_enabled(mocker):
    """When UCP is enabled, main() should skip credential extraction from params
    and pass empty strings to Client constructor."""
    from Salesforce_IAM import main

    mocker.patch("Salesforce_IAM.should_use_ucp_auth", return_value=True)
    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "url": "https://test.salesforce.com/",
            "insecure": False,
            "proxy": False,
        },
    )
    mocker.patch.object(demisto, "command", return_value="test-module")
    mocker.patch.object(demisto, "args", return_value={})

    mock_client_constructor = mocker.patch("Salesforce_IAM.Client")
    mocker.patch("Salesforce_IAM.test_module", return_value="ok")
    mocker.patch("Salesforce_IAM.return_results")

    main()

    call_kwargs = mock_client_constructor.call_args
    assert call_kwargs[1]["conn_client_id"] == ""
    assert call_kwargs[1]["conn_client_secret"] == ""
    assert call_kwargs[1]["conn_username"] == ""
    assert call_kwargs[1]["conn_password"] == ""


def test_main_extracts_credentials_when_ucp_disabled(mocker):
    """When UCP is disabled, main() should extract credentials from params."""
    from Salesforce_IAM import main

    mocker.patch("Salesforce_IAM.should_use_ucp_auth", return_value=False)
    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "url": "https://test.salesforce.com/",
            "credentials": {"identifier": "myuser", "password": "mypass"},
            "credentials_consumer": {"identifier": "my_client_id", "password": "my_client_secret"},
            "insecure": False,
            "proxy": False,
        },
    )
    mocker.patch.object(demisto, "command", return_value="test-module")
    mocker.patch.object(demisto, "args", return_value={})

    mock_client_constructor = mocker.patch("Salesforce_IAM.Client")
    mocker.patch("Salesforce_IAM.test_module", return_value="ok")
    mocker.patch("Salesforce_IAM.return_results")

    main()

    call_kwargs = mock_client_constructor.call_args
    assert call_kwargs[1]["conn_client_id"] == "my_client_id"
    assert call_kwargs[1]["conn_client_secret"] == "my_client_secret"
    assert call_kwargs[1]["conn_username"] == "myuser"
    assert call_kwargs[1]["conn_password"] == "mypass"


def test_main_errors_on_missing_consumer_keys_when_ucp_disabled(mocker):
    """When UCP is disabled and consumer key/secret are missing, main() should call return_error.
    In production, return_error calls sys.exit(0), so we simulate that with SystemExit side_effect."""
    from Salesforce_IAM import main

    mocker.patch("Salesforce_IAM.should_use_ucp_auth", return_value=False)
    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "url": "https://test.salesforce.com/",
            "credentials": {"identifier": "myuser", "password": "mypass"},
            "insecure": False,
            "proxy": False,
        },
    )
    mocker.patch.object(demisto, "command", return_value="test-module")
    mocker.patch.object(demisto, "args", return_value={})

    mock_return_error = mocker.patch("Salesforce_IAM.return_error", side_effect=SystemExit(0))

    with pytest.raises(SystemExit):
        main()

    mock_return_error.assert_called_once_with("Consumer Key and Consumer Secret must be provided.")


def test_existing_commands_work_with_ucp_enabled(mocker):
    """When UCP is enabled, commands like get_user_command should still work.
    The client.token will be None but _http_request handles UCP auth injection."""
    mocker.patch("Salesforce_IAM.should_use_ucp_auth", return_value=True)

    client = Client(
        demisto_params={},
        base_url="base_url",
        conn_client_id="",
        conn_client_secret="",
        conn_username="",
        conn_password="",
        ok_codes=(200, 201, 204),
        verify=True,
        proxy=True,
    )

    assert client.token is None

    args = {"user-profile": {"email": "mock@mock.com"}}
    mocker.patch.object(client, "get_user", return_value=SALESFORCE_GET_USER_OUTPUT)
    mocker.patch.object(client, "get_user_id_and_activity_by_mail", return_value=("id", None))
    mocker.patch.object(IAMUserProfile, "update_with_app_data", return_value={})

    iam_user_profile = get_user_command(client, args, "mapper_in", "mapper_out")
    outputs = get_outputs_from_user_profile(iam_user_profile)

    assert outputs.get("action") == IAMActions.GET_USER
    assert outputs.get("success") is True
    assert outputs.get("active") is True
    assert outputs.get("id") == "12345"
    assert outputs.get("username") == "TestID@networks.com"