Using Named credential for obtaining sessionid

Question

Currently my code uses salesforce partner wsdl of another salesforce org and obtain the session id. Below is code

    // apex callout
    partnerSoapSforceCom.Soap partner = new partnerSoapSforceCom.Soap();
    AcustomSetting__c configs = AcustomSetting__c.getValues('AcustomSettingRecord');
    String endpoint = configs.End_Point__c;
    String userId = configs.userID__c;
    String password = configs.password__c;
    partner.endpoint_x = endpoint ;
    partnerSoapSforceCom.LoginResult lr = partner.login(userId,password);
    System.debug('Session Id obtained===========' + lr.sessionId); 

And in subsequent request I add the JsessionId in the header for authroization:

   Http http = new Http();
    HttpRequest req = new HttpRequest();
    // Endpoint of the API
    req.setEndpoint('Endpoint'); 
    req.setHeader('Content-Type','application/json'); 
    //req.setHeader('Authorization', 'Bearer ' + lr.sessionId);    

WSDLTOApex Class function login():

public partnerSoapSforceCom.LoginResult login() {
    partnerSoapSforceCom.login_element request_x = new partnerSoapSforceCom.login_element();
    //request_x.username = username;
    //request_x.password = password;
    partnerSoapSforceCom.loginResponse_element response_x;
    Map<String, partnerSoapSforceCom.loginResponse_element> response_map_x = new Map<String, partnerSoapSforceCom.loginResponse_element>();
    response_map_x.put('response_x', response_x);
    if(!Test.isRunningTest()) {
    WebServiceCallout.invoke(
      this,
      request_x,
      response_map_x,
      new String[]{'callout:Sample_NC',
      '',
      'urn:partner.soap.sforce.com',
      'login',
      'urn:partner.soap.sforce.com',
      'loginResponse',
      'partnerSoapSforceCom.loginResponse_element'}
    );
    }
    response_x = response_map_x.get('response_x');
    return response_x.result;
}

I do not want to use this approach as storing the userid and password in Custom setting is something I do not want(password is not encrypted and is visible to everyone in the org). I would like to use named credentials for this purpose(Simple authentication in HTTP header, do not want to use OAuth though)

I read through this instruction - https://help.salesforce.com/articleView?id=named_credentials_about.htm&type=0

However, I am trying to figure out how I can fix my above to code to use named credential instead of the place where I call the partner wsdl Login - partner.login(userId,password); method to obtain session id. Any suggestions here how I can modify the code? Say the named credential is called - Sample_NC.

Answer 1

I don't believe you can use WSDL2Apex if you want to use Named Credentials. You're going to have to roll your own callout in order to use the Http classes. See also (emphasis mine):

Invoking HTTP Callouts

Apex provides several built-in classes to work with HTTP services and create HTTP requests like GET, POST, PUT, and DELETE.

You can use these HTTP classes to integrate to REST-based services. They also allow you to integrate to SOAP-based web services as an alternate option to generating Apex code from a WSDL. By using the HTTP classes, instead of starting with a WSDL, you take on more responsibility for handling the construction of the SOAP message for the request and response.

That last sentence is especially telling. So the tradeoff for using Named Credentials would seem to be taking on quite a bit more coding responsibility.

Also take a look at Apex Web Services and Callouts:

With 'Callouts', where Apex invokes an external web service, Apex provides integration with Web services that utilize SOAP and WSDL, or HTTP services (RESTful services). Apex supports the importing of WSDLs to auto-generate the corresponding Apex classes. Additionally, Apex supports HTTP services to use HTTP Request and Response objects to invoke the external web service. These concepts are covered in the Apex Callouts section.

Unfortunately there are no examples of using Http to make SOAP based calls, and indeed the documentation seems to reinforce that it is geared towards REST:

HTTP (RESTful) Services

Apex supports HTTP Services with several built in Apex classes to creating HTTP requests like GET, POST, PUT, and DELETE. There are 3 main classes:

• HTTP Class: Use this class to initiate an HTTP request and response.
• HttpRequest Class: Use this class to programmatically create HTTP requests.
• HttpResponse Class: Use this class to handle the HTTP response returned by the HTTP.Send() operation.

Together, these classes support the ability to develop HTTP request/response functionality within Apex. Using these HTTP classes supports the ability to integrate to REST-based services. It also enables the ability to integrate to SOAP-based web services as an alternate option to leveraging WSDL2Apex. By using the HTTP classes, instead of WSDL2Apex, the developer has more responsibility to handling the construction of the SOAP message both for the request and the response.

It seems like the easiest route may be to look into the steps listed out in the REST API Developer Guide:

Understanding Authentication

Salesforce uses the OAuth protocol to allow users of applications to securely access data without having to reveal username and password credentials.

Before making REST API calls, you must authenticate the application user using OAuth 2.0. To do so, you’ll need to:

• Set up your application as a connected app in the Salesforce organization.
• Determine the correct Salesforce OAuth endpoint for your connected app to use.
• Authenticate the connected app user via one of several different OAuth 2.0 authentication flows. An OAuth authentication flow defines a series of steps used to coordinate the authentication process between your application and Salesforce.
• Supported OAuth flows include:
  • Web server flow, where the server can securely protect the consumer secret.
  • User-agent flow, used by applications that cannot securely store the consumer secret.
  • Username-password flow, where the application has direct access to user credentials.

After successfully authenticating the connected app user with Salesforce, you’ll receive an access token which can be used to make authenticated REST API calls.