Salesforce is changing how integrations sign in: what to do for your community

Applies to: Classic and Aurora communities that use the built-in Khoros Community Salesforce integration, which covers:

• case escalation
• the Case Portal
• user sync
• case comments
• syncing knowledge base articles to Salesforce Knowledge

In short

Salesforce is retiring the older sign-in methods the current connector uses. Salesforce's notices: SOAP sign-in changes (005132110) and end of OAuth username-password sign-in (005461279). Here's what to do and when:

The December and January Salesforce security changes do not need a new Khoros software release or deployment. Your Salesforce admin may need to update settings in Salesforce. Depending on your configuration, your community admin may also need to update the existing Salesforce connection details. The permanent move to certificate sign-in will come separately.

If the Salesforce connection stops working, these community features can be affected:

• case escalation
• case comments and attachments
• the Case Portal
• user sync
• knowledge base sync

The rest of your community isn't affected.

Part 1: Action now, before December 1, 2026

From December 1, the connector's main sign-in only works if your integration user has the Use Any API Auth permission.

Your Salesforce admin:

• In Salesforce Setup, open Permission Sets and click New. Name it, for example "Khoros Community Connection".
• Under System Permissions, tick Use Any API Auth and save.
• Click Manage Assignments and add your community's integration user. That's the Salesforce username saved in your community's Salesforce settings. If you can't find it, raise a Khoros Support ticket and mention "Salesforce sign-in".

Nothing changes in your community for this step.

Part 2: Check before mid-December 2026

From December 15, 2026 (sandboxes) and January 31, 2027 (production), Salesforce adds two rules.

1. Broad login IP ranges.

• What changes: if your org's Network Access settings, or the integration user's profile Login IP Ranges, allow a very broad range (wider than /8 for IPv4 or /29 for IPv6), the connector's sign-in will also need the user's security token.
• What to do: ask your Salesforce admin to check these settings.
• If it applies, either narrow the IP range, or add the security token to the connection:

1. The integration user resets their token in Salesforce: personal settings → Reset My Security Token. Salesforce emails the new token.
2. In your community's Salesforce settings (Classic: Mod Tools → Salesforce → Settings; Aurora: Settings → Features → Salesforce), type the password with the token straight after it, no space, in the Password field (up to 50 characters in total).
3. Save. Saving signs into Salesforce, so if the token is wrong you'll see a sign-in error and nothing is saved.

• The connector's built-in actions use the same saved password, so there's nothing else to update. If you're unsure, contact Khoros Support, and never share your password or security token in a support ticket.
• Shared users: resetting a security token can affect any other integration that uses the same Salesforce user.

2. A one-time check for unused SOAP sign-in.

• What changes: on the same dates, Salesforce runs a one-time check and switches off the older SOAP sign-in in any Salesforce org with no SOAP sign-in activity in the previous six months. It looks at your whole org: one SOAP sign-in anywhere keeps it on, and a live Khoros connection's own sign-ins count.
• Who should check: if your Khoros connection is rarely used or paused, ask your Salesforce admin to look at your org's login history, and let us know if you still need the connection.

Part 3: Coming next, certificate sign-in

Salesforce is retiring the password-based sign-ins in stages:

• February 20, 2027: the password-based OAuth sign-in ends. Two built-in actions use it today: closing the Salesforce case when a reply is accepted as the solution, and knowledge base sync. We're preparing a compatibility update to keep these actions working while communities move to certificate sign-in, and we'll coordinate its rollout with affected communities.
• Summer 2027: Salesforce removes the older SOAP sign-in completely.

What we're doing: we're adding certificate sign-in to the connector for Classic and Aurora, as part of our 27.1 release, planned for early 2027. It's Khoros' supported replacement: the community signs in with a certificate instead of a stored Salesforce password.

• What stays: your existing setup (board mappings, Case Portal, field mappings, user sync).
• What changes: only how your community signs in.
• Works even if your current connection doesn't: you can switch to certificate sign-in even if your current password connection has stopped working.

What to expect:

• Who does the switch: your community admin and your Salesforce admin, together. Allow time for any internal security approvals on the Salesforce side.
• When: we'll let you know when certificate sign-in is available for your community, with a date to complete the switch.
• Where: we'll add the step-by-step setup to this post.

If your team has its own code that calls Salesforce

Some communities have custom code that connects to Salesforce directly. That code isn't covered by our connector update. Your developers or partner should check whether it uses:

• password-based OAuth sign-in, which ends February 20, 2027

• SOAP login, which ends Summer 2027

Not sure? Ask Khoros Support.

Need help?

• Standard connector: raise a Khoros Support ticket and mention "Salesforce sign-in". No Professional Services engagement is needed for it.
• Custom code may need your developers, your partner, or separate services work.

We'll update this post when certificate sign-in is available, and if Salesforce changes its dates.