Salesforce Authentication#

Presto can be configured to enable frontend password authentication over HTTPS for clients, such as the CLI, or the JDBC and ODBC drivers. The username and password (or password and security token concatenation) are validated by having the Presto coordinator perform a login to Salesforce.

This allows you to enable users to authenticate to Presto via their Salesforce basic credentials. This can also be used to secure the Web UI.


This is not a Salesforce connector, and does not allow users to query Salesforce data. It’s simply a means by which users can authenticate to Presto, similar to LDAP Authentication or Password File Authentication.

Salesforce Authenticator Configuration#

Enable Salesforce authentication by creating an etc/ file on the coordinator:
salesforce.allowed-organizations=<allowed-org-ids or all>

The following configuration properties are available:




Comma separated list of 18 character Organization IDs for a second, simple layer of security. This option can be explicitly ignored using all, which bypasses any check of the authenticated user’s Organization ID.


Maximum number of cached authenticated users. Defaults to 4096.


How long a cached authentication should be considered valid. Defaults to 2m.

Salesforce Concepts#

There are two Salesforce specific aspects to this authenticator. They are the use of the Salesforce security token, and configuration of one or more Organization IDs.

Security Token#

Credentials are a user’s Salesforce username and password if Presto is connecting from a whitelisted IP, or username and password/security token concatenation otherwise. For example, if Presto is not whitelisted, and your password is password and security token is token, use passwordtoken to authenticate.

You can configure a public IP for Presto as a trusted IP by whitelisting an IP range. Organization IDs#

You can configure one or more Salesforce Organization IDs for additional security. When the user authenticates, the Salesforce API returns the 18 character Organization ID for the user. The Presto Salesforce authenticator ensures that the ID matches one of the IDs configured in salesforce.allowed-organizations.

Optionally, you can configure all to explicitly ignore this layer of security.

Admins can find their Organization ID using the Salesforce Setup UI. This will be the 15 character ID, which can be converted to the 18 character ID.