User password set programmatically
Why is this an issue?
Setting user passwords programmatically using System.setPassword() bypasses Salesforce's secure password management features. This practice:
May result in weak or predictable passwords
Bypasses password history and complexity requirements
Creates security audit concerns
Can expose passwords in code or logs
Salesforce provides secure, platform-managed password flows that should be used instead.
Examples
Example of incorrect code:
public void createUserWithPassword(String username, String password) {
User u = new User(/* user fields */);
insert u;
System.setPassword(u.Id, password);
}
Example of correct code:
public void createUser(String username) {
User u = new User(/* user fields */);
insert u;
// Let Salesforce send a password reset email
System.resetPassword(u.Id, true);
}
How can I fix violations?
Use
System.resetPassword(): This sends a secure password reset email to the user, allowing them to set their own password.Use SSO: Implement Single Sign-On to eliminate the need for Salesforce-managed passwords.
Use Identity Connect: For user provisioning scenarios, use Salesforce Identity Connect or similar identity management solutions.
Resources