Here's my use case: We have API-only users who authenticate using the OAuth 2 web server flow and access SF via a ConnectedApp . At the time of auth / refresh, we want to activate a session-based permission set for the user. This provides them the requisite permissions required to perform actions against REST endpoints.

We have a connected app handler class that extends Auth.ConnectedAppPlugin. The issue is, when providing implementation for the authorize() and refresh() methods, I try to make a call to UserInfo.getSessionId() and Auth.SessionManagement().getCurrentSession which return null and throws an exception, respectively.

I can't activate the permissions from the endpoints themselves because then I get the mixed-DML operations exception. I realize I could use a normal permission set but I'd prefer session-based.

A copy of the genericized code for my connected app plugin class is below. Any thoughts would be greatly appreciated!

public class CustomCloudConnectedAppPlugin extends Auth.ConnectedAppPlugin {

    public override Boolean authorize(Id userId, Id connectedAppId, Boolean isAdminApproved, Auth.InvocationContext context) {
        if (!isAdminApproved)
            return false;

        // custom class to encapsulate assignment logic 
        ConnectedAppPermissioner cap = ConnectedAppPermissioner.getAppPermissioner(PhynCloudConnectedAppPlugin.class, userId); 

        // sanity check - throws exception

        return true; 

    public override void refresh(Id userId, Id connectedAppId, Auth.InvocationContext context) {
        // returns null

  • Does your ConnectedAppPermissioner class depend on having an active session? – Daniel Ballinger Nov 15 '17 at 1:49
  • 1
    Only to the extent that a sessionId is required to insert a SessionPermSetActivation record. The instantiation of the class itself doesn't require it. – alphaBytes Nov 15 '17 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.