Type of Security between Genesys Cloud and Salesforce

[David_Fradejas]

Hi experts!

I would like to know deeply how is the integration in terms of security , between GC and SFDC.

I know the authentication flow with the Salesforce REST api is an Oauth flow (authenticating against the login URL for Salesforce, which returns an auth token that is leveraged on the subsequent API calls), but i would like to know if it uses mTLS or not, or if is just HTTPs with TLS)...could you give more details about it?

let me show you what i mean regarding conections:

[Richard.Schott]

In the case of data actions, it entirely depends on the configuration you've set within your Salesforce org as to whether it leverages mTLS. In the event you have configured your Salesforce org to require mTLS, then the data action service will present it's certificates as part of the initiation of the TLS handshake, as defined in the Salesforce documentation: https://help.salesforce.com/s/articleView?id=000383575&type=1. It will be up to the Salesforce admin to establish the trust relationship with the Genesys Cloud Data Action Certificate Authority: MTLS support for data actions - Genesys Cloud Resource Center

In the case of the Genesys Cloud for Salesforce embedded client, which is what you posted the architecture diagram of, none of that applies. The client is operating inside the user's browser, embedded in an iFrame supplied by the Salesforce OpenCTI framework. Because the user is authenticated within Salesforce in order to even render the iFrame that loads the embedded client, and the user is authenticated within Genesys Cloud by logging in to the client, there is an inherent trust between the two applications. The Genesys Cloud for Salesforce client is communicating directly with the Salesforce JavaScript APIs for the OpenCTI framework and Salesforce Console APIs, as indicating in the lower right corner of the architecture diagram. These JavaScript API calls are made in the context of the authenticated user in Salesforce, inheriting that user's permissions to access resources, modify data, etc. The Salesforce web application proxies those requests back to their services using whatever protocols are leveraged by their application (typically REST API calls, but that may vary based on the specific operation; if you have more questions about how the JavaScript APIs ultimately interact with the Salesforce platform, those are questions to be answered by Salesforce and their developer documentation).