Salesforce API module encryption warning

Question

I started working on a legacy Drupal 7 site that uses the salesforce_api at version 7.x-2.0-alpha3 (yes, it's ancient). I noticed in the status report page the following warning:

There is a link on the warning that goes to the Salesforce module configuration page, but no real direction what to change to encrypt this properly.

Does anyone know what could be missing from the Salesforce configuration to throw this warning? Is it because the module is so old? That's my suspicion, but after googling around, nothing came up on that warning at all.

Answer 1

This is most likely related to AES encryption on your Salesforce credential data, not the connection itself. From the relevant doc page:

By default, all Salesforce credentials are stored in the variables table, unencrypted. If this is a problem for you, this module supports encryption via the AES module

When you have the AES module enabled (which it seems like you do), the message you see in your site status report is:

Salesforce encryption is enabled but not configured securely.

And if AES is not enabled, you see this instead:

Encryption is unavailable. Using encryption is recommended in order to better secure your data.

Check out salesforce_api_requirements() and salesforce_api_encryption_available() for more. From the logic in the latter it looks like there was an attempt to return more useful information (specifically about the AES module) along with that generic "salesforce encryption" message, but for whatever reason that text never propagated up to what was printed to the screen.