I have following situation. There has been defined partner trust between Salesforce and our XY web application. These are under OAuth 2.0 compliance. We have defined XY package with client key, secret and scopes. Package was registered in SF. XY is registered as connected app.
SF is calling XY SOAP API. Further in our SOAP API web method I want to call SF SOAP services to obtain user's details. To do that I need access token. How to accomplish this ? Because I am in web method I can not perform neither username-password flow (I do not know SF users credentials) nor web flow (I can not realize web redirections within web method). Which flow I have to use. Currently our partners are providing us (when calling our web method) session id. This session Id I can not use because our application should be in OAuth 2.0 trust.
What are suggestions here ? Is there any additional OAuth 2.0 flow that I can use in this use case ?
UPDATE We can not use session id to call SF SOAP API because it was set in SF in connected app options App Access Settings :
So any call with session id in SOAP message header will result with INVALID SESSION ID error from SF side. We had same issue with other OAuth flows and it did worked only for AccessToken. That issue is described here