Use Case

Token based authentication (TBA) allows you to generate secure, revocable, non-expiring tokens for integration clients such as the NetSuite Connector to use when connecting to NetSuite. This is strongly recommended instead of the traditional User Name and Password combination because the end user credentials are never exposed and the Password does not expire. Because a token is only used by a single Application, it provides visibility into which Applications are connecting to NetSuite and control to revoke access. Additionally, from NetSuite version 2020.2, user credential authentication has been deprecated in favor of token-based authentication.

Token Based Authentication is available for Web Services using SuiteTalk version 2015.2 and above.
 

Implementation

NetSuite Setup

The following is a detailed step-by-step instruction on how to setup Netsuite to use Token Based Authentication. Screenshots will be attached with each step, and a video outlining what was done is shown here:
How To - Netsuite TBA. 

1. Obtain your NetSuite Account ID. Go to Setup > Integration > SOAP Web Services Preferences. As shown below, my Account ID is 'TSTDRV1846242'. Take note of this value as it will be used later. 

 

2. Enable Token Based-Authentication for your NetSuite Account. Go to Setup > Company > Enable Features. Once selected, click on 'SuiteCloud' and navigate to 'Manage Authentication'. One of the options should be 'Token-Based Authentication', which is seen below. Please check this option. 

 

3. Create a new Custom Role for use by the TBA User. Go to Setup > Users/Roles > Manage Roles > New. Add a Name for the Role and we will begin adding Permissions as needed.

 

IMPORTANT: You must create a new Role. You cannot use one of the Standard Roles.

• On the 'Permissions' Subtab (bottom of the screen), grant the appropriate access to 'Transactions', 'Reports', 'Lists', and 'Custom Records' as required for the Integration scenario. Note that for 'Custom Fields' and 'Custom Records', you will need to grant a number of permissions under the Setup tab. The following article can help with the specific permissions if needed. In the screenshot shown below, I set up my User for Full Access to Cash Sale Transaction Records, but this will vary per use case.

• On the 'Setup' Subtab next to 'Lists', select 'User Access Tokens' and 'SOAP Web Services' at a minimum for your Role. Other Permissions should be added per Integration use-case This is shown below:

 

Other Notes to Consider:

• If using NetSuite OneWorld edition, ensure the Role has access to the appropriate subsidiaries.
• If calling RESTlets, ensure 'Web Services Only Role' is Unchecked.

 

4. Assign the Role to the desired User. For this example we will be creating a new User, as we recommend creating a dedicated Integration User (for security and to reduce the chance of this User being locked out). Go to Lists > Employees > Employees > New and Create an Employee. My template is shown below, but fill out the given fields as needed.

 

Once this is complete, select Access > Roles and add the Role previously created (my Role was 'TBAUser'). Note that you need to either 'Give Access' and/or 'Send a Notification Email' for the Role to be saved when a User is first created. I manually assigned a password for this example (under 'Manually Assign Or Change Password'). This is shown below:

 

Note: If you are using an already created Employee, please search for and identify the User required (Lists > Employees > Employees > Search) and select ‘Edit’ to add the Role previously mentioned. The same steps apply as shown above. 

 

5. Install the free Boomi for Integration and EDI SuiteApp (SuiteApp Bundle ID: 492145) into your NetSuite account. This includes an Integration Record that you will use while configuring your access token.

 

6. Create a new Access Token. Go to Setup > Users/Roles > Access Tokens > New. Select ‘Boomi Integration’ for the application name, the User (my example was 'M Hartmann', you can Search for this User fairly easily), and the Role created (my example was 'TBA User'). A screenshot of this is provided below:

 

• Click 'Save', and on the confirmation screen, note the Token ID and Token Secret. Copy these values temporarily to a text editor for future reference.
• IMPORTANT The Token ID and Secret are ONLY DISPLAYED ONCE. If you forget/lose these values you will need to regenerate them and reconfigure the NetSuite Connector within Boomi Enterprise Platform.

 

Boomi Enterprise Platform Connection Setup

 

1. Create a NetSuite Connection component preferably using the latest version. However, at any time NetSuite supports the latest 6 versions available, see here for more details.

• Leave the User and Password fields blank.
• Configure Account Number (this is the Account ID), Token Id, and Token Secret with the values generated during the NetSuite setup. Additionally, tick the ‘Use Boomi Integration Record’ checkbox
  • Note: DO NOT enter the ‘Token Secret (Deprecated)’ value. Rather, use the ‘Click to Set’ values for ‘Token Secret’. Once set these values will be ‘Encrypted’, which is shown below. 

 

2. Try selecting 'Test Connection' to ensure the information was filled out properly. A successful Connection would be indicated by the following: 

 

• If the Connection fails, ensure you filled out all of the correct information per fields requested and/or your endpoint accepts traffic from the basic runtime used for testing. 

3. Try importing your Netsuite Operation using the Connection created. For my example I imported using the 'Cash Sale' Object, as I gave my User full access to those Records previously. Once completed, you should see an Operation such as this:

4. Feel free to begin testing, as your Connection component should now be working successfully. 

 

Usage Considerations

• Because you must create a Custom Role, be sure to grant permissions to all the record types required by your integration scenario. Reference the article previously linked and shown here. 
• If some of these fields/items are not visible on Netsuite, your user most likely does not have the proper permissions. Please reach out to your Netsuite Admin accordingly. 
• The Integration record provides a pre-filtered view of the web services usage logs for only that application.
• The token values cannot be used to log into the NetSuite UI.
• TBA uses request-level authentication which has slightly slower performance than session-based. However, it allows the NetSuite data center to load balance subsequent requests. The NetSuite Connector currently uses request-level authentication for User credential-based authentication.
• Web service calls made using TBA are governed by the same API limits as non-TBA calls with respect to concurrency and request rates. You still must obtain a SuiteCloud Plus license from NetSuite to make more than one call at a time for a given Integration record.
• In the past, our setup guides explained how customers could create their own Integration Record in their NetSuite environment, as opposed to installing the Integration Record included in the Boomi for Integration and EDI SuiteApp. This is still supported by the Boomi NetSuite connector by leaving the ‘Use Boomi Integration Record’ checkbox unticked and completing the Application ID, Consumer Key and Consumer Secret fields with the values of your Integration Record.