Dependency Types Reference
Overview
Section titled “Overview”OrgGuard discovers five types of certificate dependencies. Each type represents a Salesforce configuration element that references a certificate. When the certificate expires, these configurations may fail silently or produce errors.
This page provides technical details for each dependency type. For a task-focused guide, see Certificate Dependencies.
Named Credential
Section titled “Named Credential”| Field | Value |
|---|---|
| DependencyType__c value | NamedCredential |
| Data source | Org configuration (NamedCredential entity) |
| What is captured | DeveloperName, record ID |
| Relationship to certificate | Named Credentials that use mutual TLS or client certificate authentication reference a Salesforce certificate by name |
What it means: When the referenced certificate expires, all callouts using this Named Credential will fail with a TLS handshake error. If multiple Named Credentials share the same certificate (common in failover or multi-endpoint patterns), all of them appear as separate dependencies.
Limitations: Named Credentials configured via External Credentials may not directly reference the certificate at the Named Credential level. OrgGuard resolves the certificate reference from the External Credential when possible.
Identity Provider
Section titled “Identity Provider”| Field | Value |
|---|---|
| DependencyType__c value | IdentityProvider |
| Data source | Org Identity Provider configuration |
| What is captured | Certificate name |
| Relationship to certificate | The org’s Identity Provider uses this certificate to sign SAML assertions sent to external Service Providers |
What it means: When the referenced certificate expires, all SSO flows where Salesforce acts as the Identity Provider will fail. External applications relying on Salesforce-issued SAML assertions will be unable to authenticate users.
Limitations: Only one Identity Provider can be configured per org. If the org’s Identity Provider is disabled, no dependency is recorded. The Identity Provider is surfaced only on the certificate’s Blast Radius tab — it is not tracked as a standalone asset in the Asset Inventory because the configuration is a single org-level toggle rather than a discrete record with its own lifecycle.
SAML Identity Provider
Section titled “SAML Identity Provider”| Field | Value |
|---|---|
| DependencyType__c value | SAMLIdP |
| Data source | Org configuration (SamlSsoConfig entity) |
| What is captured | Configuration name, record ID |
| Relationship to certificate | SAML SSO configurations that use a signing or encryption certificate |
What it means: When the referenced certificate expires, SAML-based single sign-on flows will fail. Users authenticating via this SAML configuration will be unable to log in.
Limitations: Only SAML configurations where Salesforce holds the certificate are discovered. If the external IdP provides the signing cert and Salesforce only validates it, the dependency is on the IdP side and is not tracked by OrgGuard.
Outbound Message
Section titled “Outbound Message”| Field | Value |
|---|---|
| DependencyType__c value | OutboundMessage |
| Data source | Org configuration (OutboundMessage entity) |
| What is captured | Message name, record ID |
| Relationship to certificate | Outbound Messages that use client certificate authentication when calling the endpoint |
What it means: When the referenced certificate expires, outbound messages will fail to authenticate with the receiving endpoint. Messages will queue and retry according to Salesforce’s retry policy, but will not succeed until the certificate is renewed.
Limitations: Outbound Messages that rely on IP allowlisting rather than client certificates will not appear as dependencies.
Connected-App JWT Bearer
Section titled “Connected-App JWT Bearer”| Field | Value |
|---|---|
| DependencyType__c value | JWTConsumer |
| Data source | Org configuration (ConnectedApplication entity, JWT consumer configuration) |
| What is captured | Application name, record ID |
| Relationship to certificate | Connected Apps acting as JWT consumers that verify incoming assertions against a certificate |
What it means: When the referenced certificate expires, incoming JWT assertions signed with the corresponding private key will fail validation. This affects external systems that authenticate to Salesforce via JWT bearer tokens — CI/CD pipelines, data loaders, and server-to-server integrations.
Limitations: Connected Apps that use OAuth authorization code flow (not JWT) do not reference a certificate and will not appear as dependencies.
Summary table
Section titled “Summary table”| Type | Typical failure mode | User impact |
|---|---|---|
| NamedCredential | TLS handshake failure on callouts | Integrations stop sending/receiving data |
| IdentityProvider | SAML assertion signing failure | SSO flows fail for all apps that trust Salesforce as their IdP |
| SAMLIdP | SAML assertion validation failure | SSO login fails for all users on this config |
| OutboundMessage | Client cert auth failure on delivery | Messages queue indefinitely |
| JWTConsumer | Incoming JWT assertion validation failure | External systems cannot authenticate to Salesforce |