3

I am in the process of creating a custom SOAP apex web service using webservice keyword so that external system can call this apex web service. I am not using Apex REST.

From the class I can create WSDL and share it with the external system. Apex REST clearly documents that it supports OAuth and Session ID authentication but no documentation for Apex SOAP Web service.

How can I secure this apex SOAP web service ? What authentication mechanism is supported ? How can external system connect to it securely ? Do they have to pass salesforce username/password/token?

Improve this question

1 Answer 1

Reset to default
3

You need to pass in a Session ID that has API access. You can get this Session ID any way you want, including SOAP login() (see Setup > Develop > API for the WSDL files), SAML authentication via Single-Sign On (SSO), the Session ID from a Workflow Outbound Message, or any of the OAuth flows (Web Server, Client, or Username-Password). You provide the Session ID through the SessionHeader provided by the WSDL.

You'll want to check the appropriate documentation for your chosen method of logging in. The SOAP login() and the OAuth Username-Password flows require directly handling the username and password, while the other methods handle the login through other means, such as logging in through a WebForm.

Improve this answer
8
  • Hi, could you provide an example of code used to obtain a session ID? Does this mean that every call to a web service actually requires two calls, one to obtain the session ID and another to access the custom web service? Thanks
    – number41
    Commented Apr 25, 2020 at 0:16
  • @number41 Session Ids are valid for as long as they are used or until they expire. You don't need to log in repeatedly, just store the session ID for later. As far as a code example, there's plenty out there on the web already. You just need to find an example in your chosen programming language.
    – sfdcfox ♦
    Commented Apr 25, 2020 at 2:10
  • @ sfdcfox Thanks for this! Can any API request use any session ID, even if every login call generates a different session ID? I don't know why it's more difficult than I imagined to find examples and specific documentation, it all seems very vague and without examples.
    – number41
    Commented Apr 25, 2020 at 5:03
  • And if I could - how does this differ from a connected app consumer key/secret?
    – number41
    Commented Apr 25, 2020 at 5:18
  • @number41 There's basically three levels of tokens. The SOAP, Classic UI, and Visualforce tokens should be good for any API. The OAuth tokens can be restricted by scope (admin/developer defined), so a dedicated Connected App should be used to control access. Lightning tokens are not valid for most APIs, except those used by Lightning (e.g. EMP and UI). A key/secret is used to authenticate an app, not authorize a user. See this answer.
    – sfdcfox ♦
    Commented Apr 25, 2020 at 10:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .