Enabling the Envestnet Tamarac integration - SPA

Conor Curtis

Integration Summary

Our integration with Tamarac allows you to keep your Practifi Client, People & Asset records in sync with Tamarac’s Households, Clients & Accounts, as well as providing deep links from Practifi directly into Tamarac records. The information flow between systems functions as below:

Practifi		Tamarac
Client	🠜 Real-time 🠞	Household
People	🠜 Real-time 🠞	Client
Asset	🠜 Manual	Account

Single Sign On (SSO) Limitation

The Tamarac Salesforce app allows the user to view a linked Household in the Tamarac Reporting portal from within Practifi, using an Open in Tamarac button. However, this feature is only accessible to a user who meets the following two criteria:

Must have an Enterprise Administrator account in Tamarac.
AND must be a Practifi user of the System Administrator Profile with the Customize Application permission assigned.

If meeting the above requirements leads to compliance and security issues for the firm, a client firm should not activate this SSO feature, and not enable the Open in Tamarac button. To view a Practifi client in Tamarac the users should open a separate browser tab and log on directly to their Tamarac account and search for the client.

Please note: Password changes made to the user that authenticated the integration will cause issues within the integration. If the password was changed in either Practifi or Tamarac then the integration needs to be reconfigured.

Enabling the integration

NOTE: The process of enabling the Tamarac integration is somewhat technical. If you have any difficulties doing so, please contact your Practifi Customer Success Manager to help get you up and running.

1. Install the Tamarac package

1. Set up My Domain

From Practifi, click your avatar in the top-right corner to view the Settings menu and select Salesforce Setup.
In the Quick Find/Search bar, search for and click on My Domain.
Under Choose Your Domain Name, enter your desired domain name and click Check Availability.
When you have a domain name, click Register the Domain. Once registration is complete, you will receive an email that says your domain is ready for testing.
Copy the complete URL of your domain; you'll provide this to Tamarac in the next step.

2. Create a self-signed certificate

Tamarac advises that the creating and sending of this certificate to them is a one-off exercise, and the expiry date is not important. It does not need to be renewed upon expiry.

From Salesforce Setup, in the Quick Find/Search bar, search for and click on Certificate and Key Management.
Click the Create Self-Signed Certificate button in the Certificates section.
Give the certificate a name, then click out of the text box; the Unique Name field should automatically populate. Then click Save to be taken back to the Certificate page where you'll see the one you just created.
Click the Certificate Name to be taken to a page where you can download a copy.
Change the file extension of the downloaded certificate from .crt to .txt.

3. Send information to Tamarac

You'll need to provide the following information to the Tamarac Service Team:

The domain URL you created in step 1
The certificate file you downloaded in step 2
The Salesforce organization ID (found on the Company Information page in Salesforce Setup)

4. Install the application

In your web browser, enter the URL received from the Tamarac Account Management team.
Click Get it now.
Log in to the AppExchange using your Practifi login.
Select Install in Production.
Click Agree, then Confirm & Install.
Log in to Practifi. You must use an administrator login.
Under Install Tamarac Advisor View, select Install for All Users and click Install.
In the Approve Third-Party Access window, select Yes, grant access to these third-party websites and click Continue. The app will install.
When the app has installed, on the Installation Complete! page, click Done.

2. Configure Salesforce settings

1. Remote Site

In the Quick Find/Search bar in Salesforce Setup, search for and click on Remote Site Settings.
Under All Remote Sites, under Action, click Edit.
Under Remote Site Edit, complete the following fields then click Save:

SETTING	WHAT TO ENTER
Remote Site Name	Leave as the default value.
Remote Site URL	Enter: https://advisorapi.tamaracinc.com
Description	Optional.

2. Connected App and Permission Settings

In the Quick Find/Search bar in Salesforce Setup, search for and click on Identity Provider.
Click Enable Identity Provider.
Select the self-signed certificate you created earlier, then click Save.
In the Quick Find/Search bar in Salesforce Setup, search for and click on Connected Apps.
Click the Edit link for the Tamarac connected app.
Under SAML Service Provider Settings, complete the following fields:

SETTING	WHAT TO ENTER
Entity ID	Enter: https://portal.tamaracinc.com
ACS URL	Enter: https://integrationservices.tamaracinc.com/genericsso.aspx
Subject Type	Select: User ID
Name ID Format	Leave as the default value.
Issuer	Enter your Salesforce domain URL you created previously.
Idp Certificate	Select the self-signed certificate you created previously.

Click Save and you'll return to the Connected Apps page.
Click on the Tamarac app's name to be taken to the Manage Connected Apps page. Look for SAML Login Information and copy the IdP-Initiated Login URL. You will need this to set up the custom metadata later.
Set which profiles should have SSO access from Salesforce to Tamarac:
- On the Manage Connected Apps page, look for Profiles.
- Click Manage Profiles.
- Select all Practifi user profiles, along with System Administrator, then click Save.
Ensure Custom Setting Permissions the Profile the Users are assigned to are enabled for Tamarac
- Note the Profile Name(s) of the Users requiring access to Tamarac
- In the Quick Find/Search bar in Salesforce Setup, search for and click on Users
- Locate the Profiles section
- From the list of Profiles, choose the required Profile name (example here is System Administrator)
- From the Profile panel skip to the Enabled Custom Setting Definitions Access section by sublink

- Click Edit on the Enabled Custom Setting Definitions Access section

- Ensure the Tamarac.TamAdvisor.Tamarac.etc Custom Setting Definitions are listed in the Enabled column, and click Save

3. Custom Metadata Type

In the Quick Find/Search bar in Salesforce Setup, search for and click on Custom Metadata Types.
Under All Custom Metadata Types, under Label, click Advisor View Setting.
Under Custom Metadata Type Detail, click Manage Advisor View Settings.
Under Advisor View Settings, click Edit.
Complete the following fields, then click Save.

SETTING	WHAT TO ENTER
Enterprise ID	This is your Tamarac Enterprise ID. Contact the Tamarac Service Team if you need assistance finding your Enterprise ID.
Local IdP Initiated Login URL	Copy and paste the IdP-initiated Login URL from the Connected App.
Override Base URL	Copy the base URL from the Base URL field to the left and add /api.

4. SSO Authentication

NOTE: As outlined above the Tamarac Salesforce app supports users viewing a linked Household in the Tamarac Reporting portal from within Practifi, using an Open in Tamarac button. However, this feature is only accessible to a user who meets the following two criteria:

Must have an Enterprise Administrator account in Tamarac.
AND must be a Practifi user of System Administrator Profile with the Customize Application assigned.

If meeting the above requirements leads to compliance and security issues for the firm, the client firm should not activate this SSO feature, and not activate the Open in Tamarac button. To view a Practifi client in Tamarac the users should open a separate browser tab and log on directly to their Tamarac account and search for the client.

If you wish to proceed:

Notify the Tamarac Service Team that your Practifi instance is ready for single sign-on (SSO) integration. The team will configure their systems to allow SSO to take place.
When they inform you that the Single Sign-On integration is complete, log into Practifi and navigate to Salesforce Setup.
Select the Tamarac app from the App Selector in the top-right corner.
Click the Configuration tab.
To authenticate the Tamarac Reporting credentials for Salesforce, enter your Tamarac Reporting credentials in the first section (these credentials must be for an Enterprise Administrator). Click Save.
To authenticate the Salesforce Credentials for Tamarac Reporting, in the Salesforce OAuth Settings section, click Change Salesforce Login and enter your Salesforce credentials. (these credentials must be for a user of the System Administrator profile and assigned with the Customize Application permission, and must be for the same user as the Tamarac ones). Click Allow.

5. Map Asset fields

By default, the Tamarac package is configured to suit the Salesforce data model. In order to see Tamarac Assets in Practifi, we need to adjust the field mapping.

Select the Tamarac app from the app-selector in the top-right corner of Salesforce Setup.
Go to the Manage Mappings tab, click Del next to Financial Account and confirm the deletion in the pop-up window.
Click the New Mapping button in the top-right corner to go to the Configure Object Mapping page.
Complete the page as below:
- Tamarac Entity: Financial Account
- Salesforce Object: Asset/Liability
- Account Name: Description
- Account Number: Account Number
- Account Type: Notes
- CRM Id: Record ID
- Household CRM Id: Client
- Tamarac Id: External Number 5
- Updated by Tamarac Integration: Updated by Tamarac Integration
Click Save and then Send Mappings to confirm the mapping.

6. Enable in Practifi

From Practifi, click your avatar in the top-right corner to view the Settings menu and select Settings.
Select the Config tab in the left-hand navigation menu
Expand the Tamarac section in the Integrations menu and click Enable Tamarac.

Troubleshooting

Reconfiguring After Password Change

Password changes made to the user that authenticated the integration will cause issues within the integration. If the password was changed in either Practifi or Tamarac then the integration needs to be reconfigured using the following steps.

In Practifi:

Sign in to Practifi and navigate to the Tamarac App's Configuration Page.
On the top portion, reenter the Email and Password for Tamarac Reporting in the boxes available and select Save.
Once these steps are completed, sign out of Practifi.

In Tamarac:

Sign into Tamarac.
In the Browser search bar, enter the following URL: https://portal.tamaracinc.com/salesforcesettingdetails.aspx
On this page click the "Change Salesforce Login" button on the right of the page.
A Salesforce login page will pop up. Enter the Practifi Credentials and press Save.
You may be presented with another Popup asking to "Allow" Tamarac to access Salesforce through the API. Click Allow.
Next, sign back into Practifi and head to the Tamarac Manage Mapping page. Click the Send Mapping button.