Using Third-Party Generated Certificates in HTTPRequest Calls

I've been doing various integrations with external web services lately and have learned some things along the way. The latest integration I did required two-way authentication.  The Salesforce documentation makes some assumptions about these integrations-

1. That the service you're integrating with provides a parseable WSDL.
2. That the service you're integrating with allows you to upload a signed certificate that was generated from Salesforce for the two-way integration.

And if both of those hold true, the Salesforce documentation (and various related blog posts) will be sufficient for you.  However-

1. Not all services provide a WSDL, and even those that do might include XML elements that are not supported by Salesforce.  In this case, you're on your own for writing an Apex class to interact with the web service.
2. Some services provide a WSDL that Salesforce can parse, but you'll find that you need to edit the resulting Apex class to include properties that were excluded.  Though I didn't dig in to see if this was the fault of the WSDL file itself or the parser, I suspect the latter.  How to go about editing that generated Apex class is worth it's own post.
3. Some services provide you with a client certificate file that you need to include in your request- you don't have the option of generating one in Salesforce and getting it signed.

None of these are insurmountable, but they'll take a lot more leg-work on your part and in the case of having to provide a third-party generated client certificate in an HTTP request, I found myself having to piece together how to do so from various forum posts.  So I'll focus on that today.  

So an external service (in my case, the credit card processor First Data) provides you with a client certificate file and a password for that file.  Now what?  In Salesforce's documentation for the HTTPRequest class you'll notice a method called "setClientCertificate" with a note that this method is deprecated and you should really use "setClientCertificateName".  But if you've been provided with the client certificate, "setClientCertificate" is what you'll need.  Here's how to get it to work-

• Upload the client certificate as a Static Resource
• In Apex, query for that file and base64 encode the body of the file into a string variable.
• In your HTTPRequest variable, use the setClientCertificate method with the base64 encoded certificate as the first argument, and the certificate password as the second argument.

Oh sure, it's easy when you know how to do it.  And a note that alternatively, you can base64 encode the certificate yourself and use the resulting string in setClientCertificate, but the above seemed a little more elegant.  The actual code to accomplish this-

String cert;

for (StaticResource sr : [Select Id, Body from StaticResource where Name =: <certfilename>]){

cert = EncodingUtil.base64Encode(sr.Body);

}

HttpRequest hReq = new HttpRequest();

hReq.setEndpoint(<url>);

hReq.setMethod('POST');

hReq.setClientCertificate(cert, <certpassword>);

If you were lucky enough to have a WSDL that Salesforce was able to parse, you'll be setting the "clientCert_x" variable of the stub to the base64 encoded string and the "clientCertPasswd_x" variable to the password.

Once again, hope this saves someone some time!

Encrypted Fields in Apex- one gotcha

I've been doing some work integrating Salesforce with a credit card processor and hit upon a issue with encrypted fields in Apex that I haven't found documented anywhere.  It may actually be entirely intentional, but without documentation it's confusing and I did see a couple other people hitting the same problem.  According to Salesforce documentation, when you work with an encrypted field in Apex, the code will always see the unmasked value of the field.  But there's an exception, if you pass an Sobject into a method, you'll find that you'll be retrieving the masked value of the field.   I've only tested with static methods so far, and it might be specific to those.

More concrete examples.  You have an Opportunity that has already been saved with a value in the Credit Card Number field, which is encrypted.  You pass that Opportunity record into the following method.

public static void EncryptedExample(Opportunity opp){

String strCC = opp.Credit_Card_Number__c;

System.debug('Can the code see the masked number 9 in this field? '     
                     +strCC.contains('9'));

//No, it can't!

}

This is only an issue if the SObject you're passing in has been saved already.  If you pass in an SObject that either hasn't been inserted or if the value of the encrypted field has been updated but not committed to the database, then that field hasn't been encrypted and masked yet and the code therefore sees the actual value.

The solution?  You'll have to query for the record within your method and then all works as expected-

public static void EncryptedExample(Id idOpp){

Opportunity opp = [Select Amount, Payment_Type__c, Deposit__c, Credit_Card_Number__c, Credit_Card_Exp__c from Opportunity where Id =: idOpp];

String strCC = opp.Credit_Card_Number__c;

System.debug('Can the code see the masked number 9 in this field? ' 
                     +strCC.contains('9'));

//Yes it can!

}

Hope this helps someone, I know I spent a couple hours baffled (at first I thought it was a mistake in my webservice callout).

Happy Terrace Garden Time

In looking back on my last two posts, they're a bit preachy and serious; time for something lighter.  This year's garden.  Last year was our first attempt at a garden on our terrace.  This year we had learned our lessons on what plants can take our windy environment and how to best care for the plants we have.  I won't blather on- have I mentioned that when I write an instant messaging widget I'm going to call it Blather? The pictures are more interesting but a quick overview of our crops-

• We upscaled last years upside-down tomatoes in a coconut fiber basket to a bigger basket (16"), and eventually a coconut fiber cover that helps keep the moisture from being blown away.  The roots from the tomatoes grow up into the fiber, it's interesting to peak under.  
• The garlic chives from last year (in the smaller basket where the tomatoes used to be) survived inside for the winter and share the basket with chocolate peppermint, which can be a nice touch in my coffee some mornings.
• There's a golden raspberry bush, which I had never heard of before, but they grow stouter than their red raspberry cousins from my childhood that would be a bit of a monster on our terrace full grown.  
• I bought a kumquat tree last fall and we had it inside for the winter.  It had kumquats when I purchased it, which we consumed over the winter, so this is the first time I get to see them growing from flowers.
• Carnival blend carrots, which will grow as purple, red, white, yellow and orange.
• Hot cherry peppers, which have turned out to be very tolerant to the wind.
• Strawberries in an upside-down commercial bag, hung inside of a reclaimed old-school metal aquarium platform.
• In the earlier pictures is a venus flytrap, which provided garden justice to a couple of plant-eating pests, but sadly now needs to be replaced.  

Late May, the Early Days

Overview of almost everything

You can see one kumquat here, it held on since last fall when I bought the tree

Top-down view into the raspberry water bottle / greenhouse. Wasn't it cute?

Mid-June, the flowering begins (as do excited visits from bees)

And if you look just above the basket in the center, the Empire State Building.  Much better in person

Once the raspberry outgrew it, the hot cherry pepper plant spent some time in the greenhouse

The first of the tomato flowers

Rokku enjoys the garden as well

 Over time, we gave all of the plants watering spikes with their own supply of water, it got them through the hot, windy days of July while still yielding us plenty of fruits and veggies to eat.

Miscellaneous

For awhile, the venus flytrap was magical at night.  The hope was to attract bugs.

In the day, our sentry bee stood guard

 The fruiting

Isn't it beautiful?

Rokku always gets first dibs

Except on the hot peppers

Yay!

The kumquat begins to flower

The mint expands outwards

August

We've had a few tomato, garlic chive and hot cherry pepper meals from our garden at this point.

The golden raspberry has a decent number of flowers now

Little baby kumquats!

And Rokku heads off into the sunset

If you say "social media" just one more time!

As a tangentially related aside to the following rant- I'm really sick of the high percentage of "experts" I see on TV brought on to talk to me about technology, though they have zero background actually working in technology themselves.  And I'm talking about working in a capacity that creates technology, not just that they've used technology to blog or tweet before, or that they had an idea that they then hired actual technical people to implement for them.

It's too much with the social media.  Social media is just one small part of a larger culture of technology, and frankly not as earth-shaking as our "experts" would have us believe.  And if you don't believe that, go check the price of Facebook's stock.  It hardly even matters when you read this, that will likely hold true. And this is a company that gets non-stop, 24-hour, free advertising on television, radio, web sites, business cards... I could go on for awhile here.  But still you can't gain any traction in the market?

The only thing that surprised me about the Facebook stock plummet was how quickly it happened. I figured the bubble would hold for at least a couple months after the IPO. But despite the hype around the launch, corporations, and in particular publicly-owned corporations, are about profit and the Instagram purchase was just one of many cracks in the facade of Facebook's potential profitability.  Which reminds me, you should really check out The State of the Web, Spring 2012 on The Oatmeal.

But I digress, the whole Facebook thing has been nauseating and really worth an entry of it's own, but at the heart of the problem is the over-inflated sense of importance of social media in general.  Social media has it's place and people have found ingenious ways to make use of it.  But it's not the end-all, be-all of the evolution of human technology.  And let's not ignore how many relationships and I'm sure even lives have been destroyed with the help of social media.

Are you an organization struggling to figure out how to employ social media?  Maybe you don't have to; maybe there are other tools you should be investing in altogether.  Social media has become the hammer, and now everything is a nail.  As a consultant offering software development services, I've gotten some strange requests related to social media.  The funniest one was an organization who provides services to people with involvement in the criminal justice system asking if I could set up Facebook accounts for all of their clients that could be controlled and accessed by the organization.  Um, no, and more importantly, why on earth would you want to do that?

Oh yeah, and social media is not new.  I'm not sure how people have been convinced of this, but I'm sure everyone involved in the early development of Bulletin Board Systems in the late 1970s and early 80s cringes when they hear how "revolutionary" this all is.

You know it's bad when you forget about chocolate

A week ago I bought myself a dark chocolate bar.  It was very much an impulse buy one morning in the midst of the Client Cutover From Hell.  I slipped that bar of chocolate into my purse... and today I remember it's there.  That chocolate bar that I had a week ago decided might give some brief chemical reprieve.  And now as I sit at the tail-end of the Client Cutover From Hell, I celebrate with my chocolate.  It really tells you more about this week than much else I could say.  And yet I will.

I have a few gripes after going through this process.  These are things I have long been sick of but now that they've become the cause of much sleep deprivation, I therefore declare war on....

• Crap software companies that over-charge non-profits with promises of technology like you haven't seen since the mid-90s.  I'm looking at you, Convio Luminate!  This I think is worth a post in and of itself.
• Crap IT support who don't have any clue what they're doing. Some of my difficulties ended up being the result of having to reverse engineer what turned out to be a completely asinine domain configuration by this organization's IT support consultant.  They've already expressed dissatisfaction with this guy, and I'm going to recommend that they drop him altogether.
• Visualforce reRenders.  I used to think it was me, that there were just nuances to reRendering in Visualforce that I was missing.  And while I'm sure that is the case at times, I'm now also quite sure that the way reRender works in Visualforce can be just plain inconsistent.  I discovered in this project that pages that I wrote months ago that were working perfectly fine, now had to re-written because reRenders which previously worked no longer did.  My fellow developer and contractor has found the same thing and has taken to using a third-party Javascript to do the reRenders in many scenarious.  I'm with her (yup, another female developer!)