I'm creating in Salesforce a custom Web Service for an external system. What information should I provide in addition to WSDL of the custom WS?

  • username and password
  • impose use of tls 1.1 or higher

and for login? Do I have to provide the whole enterprise wsdl? It is not dangerous? could do any operation. Do I manually edit the wsdl leaving only the login operation?

should I indicate something else? for example provide certificates

  • Are you trying to import an external WSDL into Salesforce so you can get into an outside system, or do you want an external system to log into Salesforce? – DavidSchach Mar 13 '18 at 18:52

Salesforce already enforces TLS 1.1 or higher.

Read up on the difference between the Enterprise WSDL and the Partner WSDL. (Hint: You'll want the Enterprise WSDL, as it's strongly typed.)

Just use the Enterprise WSDL. It doesn't include security access - that is handled with regular security features in Salesforce based on the user accessing the org. There's nothing dangerous about importing the Enterprise WSDL into the external system and going from there. Don't edit it.

  • The custom web service implemented is on salesforce, I have to provide the information to communicate with SalesForce to an external system – Pericle Parquet Mar 13 '18 at 18:52
  • Sorry - still unclear. You're building a custom web service on Salesforce? Like a custom API? Also, please clarify. You want to call FROM Salesforce TO an external system? Or FROM an external system INTO Salesforce? If you want to go into the outside system, import that system's WSDL into Salesforce. – DavidSchach Mar 13 '18 at 18:54
  • sorry i'm new to the salesforce development. I implemented a Salesforce Inbound Web Service (created Apex Code and exposed as WSDL to the external system) in addition to the wsdl information what I have to give him to invoke my service? for example to log in before invoking the ws, the tls, etc ... – Pericle Parquet Mar 13 '18 at 19:30
  • Click Generate WSDL and give that to the other system. It should contain authentication information. – DavidSchach Mar 13 '18 at 19:38
  • really? in the wsdl generated by the apex class? I have not seen any login action and from soap ui I directly insert the session id retrieved using the login method of the enterprise wsdl – Pericle Parquet Mar 13 '18 at 19:43

Once the external caller is authenticated to Salesforce, their privileges are based upon the profiles and permission sets of the user under whose credentials they authenticated.

You secure integrations by locking down user permissions to only the minimum of functionality required by the integration user, not by manipulation of the exposed WSDL. Remember that an authenticated user could always connect to the REST API too, since they have valid credentials.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.