Overview

Salesforce is retiring the older sign-in methods that the built-in Khoros Community Salesforce integration uses today. This article explains what changes, what you need to do, and when. It applies to Classic and Aurora communities that use the built-in integration, which covers:

• case escalation
• the Case Portal
• user sync
• case comments
• syncing knowledge base articles to Salesforce Knowledge

The original announcement is on Atlas: Salesforce is changing how integrations sign in: what to do for your community. Salesforce's own notices are 005132110 (SOAP sign-in changes) and 005461279 (end of OAuth username-password sign-in).

In short

When	What	Who
Before December 1, 2026	Add the Use Any API Auth permission to your integration user (Part 1)	Your Salesforce admin
Before December 15, 2026	Check your Salesforce login IP settings, and follow Part 2 if they apply	Your Salesforce admin
January 2027 (release 27.1)	Switch to certificate sign-in when it's available for your community. We'll add the steps and let you know.	Your community admin and Salesforce admin

The December and January Salesforce security changes do not need a new Khoros software release or deployment. Your Salesforce admin may need to update settings in Salesforce. Depending on your configuration, your community admin may also need to update the existing Salesforce connection details. The permanent move to certificate sign-in will come separately.

If the Salesforce connection stops working, these community features can be affected: case escalation, case comments and attachments, the Case Portal, user sync, and knowledge base sync. The rest of your community isn't affected.

Where to find your community's Salesforce settings

• Classic: Mod Tools → Salesforce → Settings
• Aurora: Settings → Features → Salesforce

Your integration user is the Salesforce username saved on that page.

Part 1: Act now, before December 1, 2026

From December 1, the connector's main sign-in only works if your integration user has the Use Any API Auth permission.

Your Salesforce admin:

1. In Salesforce Setup, open Permission Sets and click New. Name it, for example "Khoros Community Connection".
2. Under System Permissions, tick Use Any API Auth and save.
3. Click Manage Assignments and add your community's integration user. If you can't find it, raise a Khoros Support ticket and mention "Salesforce sign-in".

Nothing changes in your community for this step.

Part 2: Check before mid-December 2026

From December 15, 2026 (sandboxes) and January 31, 2027 (production), Salesforce adds two rules.

1. Broad login IP ranges

What changes: if your org's Network Access settings, or the integration user's profile Login IP Ranges, allow a very broad range (wider than /8 for IPv4 or /29 for IPv6), the connector's sign-in will also need the user's security token.

What to do: ask your Salesforce admin to check these settings. If they apply, either narrow the IP range, or add the security token to the connection:

1. The integration user resets their token in Salesforce: personal settings → Reset My Security Token. Salesforce emails the new token.
2. In your community's Salesforce settings (paths above), type the password with the token straight after it, with no space, in the Password field (up to 50 characters in total).
3. Click Save. Saving signs in to Salesforce, so if the token is wrong you'll see a sign-in error and nothing is saved.

The connector's built-in actions use the same saved password, so there's nothing else to update. If you change the API URL, username or auth endpoint later, re-enter the password with the token as well.

Shared users: resetting a security token can affect any other integration that uses the same Salesforce user.

Never share your password or security token in a support ticket, email or chat. Enter them only in your community's Salesforce settings.

2. A one-time check for unused SOAP sign-in

What changes: on the same dates, Salesforce runs a one-time check and switches off the older SOAP sign-in in any Salesforce org with no SOAP sign-in activity in the previous six months. It looks at your whole org: one SOAP sign-in anywhere keeps it on, and a live Khoros connection's own sign-ins count.

Who should check: if your Khoros connection is rarely used or paused, ask your Salesforce admin to look at your org's login history, and let us know if you still need the connection.

Part 3: Coming next, certificate sign-in

Salesforce is retiring the password-based sign-ins in stages:

• February 20, 2027: the password-based OAuth sign-in ends. Two built-in actions use it today: closing the Salesforce case when a reply is accepted as the solution, and knowledge base sync. We're preparing a compatibility update to keep these actions working while communities move to certificate sign-in, and we'll coordinate its rollout with affected communities.
• Summer 2027: Salesforce removes the older SOAP sign-in completely.

What we're doing: we're adding certificate sign-in to the connector for Classic and Aurora, as part of our 27.1 release, planned for early 2027. It's Khoros' supported replacement: the community signs in with a certificate instead of a stored Salesforce password.

• What stays: your existing setup (board mappings, Case Portal, field mappings, user sync).
• What changes: only how your community signs in.
• Works even if your current connection doesn't: you can switch to certificate sign-in even if your current password connection has stopped working.

What to expect:

• Who does the switch: your community admin and your Salesforce admin, together. Allow time for any internal security approvals on the Salesforce side.
• When: we'll let you know when certificate sign-in is available for your community, with a date to complete the switch.
• Where: we'll add the step-by-step setup to this article and to the Atlas post.

If your team has its own code that calls Salesforce

Some communities have custom code that connects to Salesforce directly. That code isn't covered by our connector update. Your developers or partner should check whether it uses:

• password-based OAuth sign-in, which ends February 20, 2027
• SOAP login, which ends Summer 2027

Not sure? Ask Khoros Support.

Need help?

• Standard connector: raise a Khoros Support ticket and mention "Salesforce sign-in". No Professional Services engagement is needed for it.
• Custom code may need your developers, your partner, or separate services work.

We'll update this article when certificate sign-in is available, and if Salesforce changes its dates.