Error: "Required parameter sfdc.password is unspecified or empty", in spite of using sfdc.oauth.accesstoken

[norikoiwai]

Hi,

I've been using sfdc.oauth.accesstoken instead of sfdc.password in process-conf.xml. it was working just as I intended in the previous version . But after updating to v53.0.1, the following error came to occur.

2021-12-20 11:14:22,568 INFO  [process] process.ProcessRunner run (ProcessRunner.java:136) - Loading parameters
2021-12-20 11:14:22,583 FATAL [process] process.ProcessRunner validateConfigProperties (ProcessRunner.java:357) - Required parameter sfdc.password is unspecified or empty
2021-12-20 11:14:22,585 FATAL [main] process.ProcessRunner topLevelError (ProcessRunner.java:256) - Unable to run process process
java.lang.RuntimeException: com.salesforce.dataloader.exception.ParameterLoadException: Required parameter sfdc.password is unspecified or empty
	at com.salesforce.dataloader.process.ProcessRunner.run(ProcessRunner.java:182) ~[dataloader-53.0.2-uber.jar:?]
	at com.salesforce.dataloader.process.ProcessRunner.run(ProcessRunner.java:117) [dataloader-53.0.2-uber.jar:?]
	at com.salesforce.dataloader.process.ProcessRunner.runBatchMode(ProcessRunner.java:272) [dataloader-53.0.2-uber.jar:?]
	at com.salesforce.dataloader.process.DataLoaderRunner.main(DataLoaderRunner.java:98) [dataloader-53.0.2-uber.jar:?]
Caused by: com.salesforce.dataloader.exception.ParameterLoadException: Required parameter sfdc.password is unspecified or empty
	at com.salesforce.dataloader.process.ProcessRunner.validateConfigProperties(ProcessRunner.java:358) ~[dataloader-53.0.2-uber.jar:?]
	at com.salesforce.dataloader.process.ProcessRunner.run(ProcessRunner.java:140) ~[dataloader-53.0.2-uber.jar:?]
	... 3 more

Now I'm tentatively setting both sfdc.oauth.access token and sfdx.password to the same value, like this:

<entry key="sfdc.oauth.accesstoken" value="68c8a4..."/>
<entry key="sfdc.password" value="68c8a4..."/>

It is working, but a little strange. So, if there is not a special reason, I'd like to you fix it.

Thanks.

[ashitsalesforce]

Hi @norikoiwai , your use of oauth access token is novel in the batch mode because the access token is short-lived, requiring you to set a new one each time. Also, your workaround is interesting. If you were to set the password to any arbitrary string, not necessarily the value of access token, it will likely work (I haven't tried this myself).

Given that only username/password based auth is officially supported in the batch mode, data loader code checks for password entry in process-conf.xml, which is why you are encountering this issue. We can look into relaxing this check by checking for either OAuth access token or password being set. However, we would like to get more details as to how you are obtaining OAuth access token that's passed on to data loader batch mode to make sure that there are no other side effects or considerations.

[norikoiwai]

Hi @ashitsalesforce , thank you for your reply. I understand. Because of the password policy, we need to change environment variables of each automation system. So that I don't have to do this, I am using bash script and JWT authentication to get access token like this:

exp=`date -d "3 minutes" +%s`

header=`echo -n "{\"alg\":\"RS256\"}" | base64`
request=`echo -n "{\"iss\":\"${SFDC_CONSUMER_KEY}\", \"aud\":\"${SFDC_LOGIN_URL}\", \"sub\":\"${SFDC_USERNAME}\", \"exp\": \"${exp}\"}" | base64 -w 0`

echo ${SFDC_JWT_KEY} | base64 --decode --ignore-garbage > ./server.key

unsigned_jwt="${header}.${request}"
signature=$(echo -n "${unsigned_jwt}" | \
     openssl dgst -binary -sha256 -sign ./server.key | \
     openssl enc -base64 -A | tr '+/' '-_' | tr -d '=')

auth_info=`curl -s -X POST "${SFDC_LOGIN_URL}/services/oauth2/token" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer" \
     -d "assertion=${unsigned_jwt}.${signature}"`

access_token=`echo ${auth_info} | jq -r .access_token`

[ashitsalesforce]

Hi @norikoiwai , thanks for this clarification. I am attaching a patched version of data loader 53.0.2 that does not require password if sfdc.oauth.accesstoken is set. Let us know if that works.

MD5 (dataloader_mac.zip) = ef69efdbe912cc3994170dc99b4f31a8
MD5 (dataloader_win.zip) = a007b29015e55671b84b0600092865e3

dataloader_mac.zip
dataloader_win.zip

[norikoiwai]

Hi @ashitsalesforce , thank you for the patch. Both dataloader_mac.zip and dataloader_win.zip above are working as expected.

[ashitsalesforce]

Hi @norikoiwai , thanks for confirming the fix. Will check it in shortly.