OAuth user requirements for Salesforce Maps Products and Sales Planning

Salesforce Maps uses two connected apps one named 'MapAnything' for mobile authentication through the Salesforce Maps Mobile App and the other 'SPM Packages' which is tied to the OAuth page in the Salesforce Maps managed package settings.

The OAuth user impacts the following product functions

• Performs optimizations for routes in Advanced Routing
• Uploads results of Live Rules into customer Org in Live Tracking
• Performs optimizations for territories in Territory Planning
• Processes data management and optimizations in Sales Planning

Troubleshooting for "OAuth Error" when enabling OAuth

The following permission sets and permission set licenses are required for each product purchased:

Maps Advanced customers:

• Salesforce Maps Advanced Permission Set License assigned
• SF Maps Advanced Permission Set
• Maps Admin Permission Set

Live Tracking customers:

• Salesforce Maps Live Tracking Permission Set License assigned
• SF Maps Live Admin Permission Set
• Maps Admin Permission Set

Territory Planning customers:

• Salesforce Maps Territory Planning Permission Set License
• Salesforce Maps Territory Planning Permission Set
• Maps Admin Permission Set

Sales Planning customer:

• Data Pipelines Base User Permission Set License
• Sales Planning Admin Permission Set
• Data Pipelines Base User Permission Set

If you encounter an Open Authorization Failure error while attempting to authorize the app, consider the following troubleshooting steps to resolve the issue:

1. If using Restricted IP addresses, the IP address found on the Login History of the OAuth user needs to be whitelisted. You will see the status listed as Restricted IP and the application will be SPM Packages. Additionally, the OAuth user should have Maps Admin permission set as well as be assigned a role that is above the end-users in the Salesforce Role Hierarchy.
2. Ensure the oAuth user has the System Permission "Approve Uninstalled Connected Apps". More about the core changes for Uninstalled Connected Apps can be found in the "See Also" section below.
3. If the ORG has "API Access Control" enabled and the setting "For admin-approved users, limit API access to only allow listed connected apps" enabled in the salesforce setup, here are the additional steps that need to be taken up:
   1. From Setup, in the Quick Find box, enter OAuth, and then select Connected Apps OAuth Usage.
   2. Search for the 'SPM Packages' connected app and Install it, notice that the Permitted Users section is set to "Admin-approved users are pre-authorized".
   3. Once the connected application is installed ensure that the required user profile who is trying to authorize for the Salesforce Maps OAuth is added to the connected app.
   4. Once the above changes are complete, go back to the Connected Apps OAuth Usage in setup and ensure that the 'SPM Packages' connected app is unblocked by clicking the unblock button on the right-hand side against the app.
   5. Retry the Salesforce Maps OAuth
4. You may need to add the OAuth user's profile to the connected app if you continue getting the error message. In order to do that follow the below steps- 

1. 1. From Setup, in the Quick Find box, enter OAuth, and then select Connected Apps OAuth Usage.
      Search for the 'SPM Package' connected app and Install this connected app(if not installed already)
   2. In the Quick Find box, enter Connected Apps, and then select 'Manage Connected Apps'
      1. Click on 'SPM Packages'
   3. Navigate to the Profile Section-> click Manage Profiles and add OAuth user's profile
   4. Save and retry authorizing SF Maps app from configuration

Important:

1. To perform the OAuth set/revoke actions or see the current oauthed user from the maps settings page, users will need the following system permissions

   • View Setup and Config
   • Customize Application
     
     
2. When setting the OAuth user also ensure that the 'Off-Platform Processing Location' setting aligns with the location of your Salesforce org instance. For example, if your Salesforce org instance is based in Europe, the 'Off-Platform Processing Location' setting should also be set to Europe. This applies to all the permission groups created on the Maps settings page to must have the same off-platform processing location.