0

I'm creating in Salesforce a custom Web Service for an external system. What information should I provide in addition to WSDL of the custom WS?

  • username and password
  • impose use of tls 1.1 or higher

and for login? Do I have to provide the whole enterprise wsdl? It is not dangerous? could do any operation. Do I manually edit the wsdl leaving only the login operation?

should I indicate something else? for example provide certificates

Improve this question
1
  • Are you trying to import an external WSDL into Salesforce so you can get into an outside system, or do you want an external system to log into Salesforce?
    – DavidSchach
    Commented Mar 13, 2018 at 18:52

2 Answers 2

Reset to default
0

Salesforce already enforces TLS 1.1 or higher.

Read up on the difference between the Enterprise WSDL and the Partner WSDL. (Hint: You'll want the Enterprise WSDL, as it's strongly typed.)

Just use the Enterprise WSDL. It doesn't include security access - that is handled with regular security features in Salesforce based on the user accessing the org. There's nothing dangerous about importing the Enterprise WSDL into the external system and going from there. Don't edit it.

Improve this answer
9
  • The custom web service implemented is on salesforce, I have to provide the information to communicate with SalesForce to an external system
    – Pericle Parquet
    Commented Mar 13, 2018 at 18:52
  • Sorry - still unclear. You're building a custom web service on Salesforce? Like a custom API? Also, please clarify. You want to call FROM Salesforce TO an external system? Or FROM an external system INTO Salesforce? If you want to go into the outside system, import that system's WSDL into Salesforce.
    – DavidSchach
    Commented Mar 13, 2018 at 18:54
  • sorry i'm new to the salesforce development. I implemented a Salesforce Inbound Web Service (created Apex Code and exposed as WSDL to the external system) in addition to the wsdl information what I have to give him to invoke my service? for example to log in before invoking the ws, the tls, etc ...
    – Pericle Parquet
    Commented Mar 13, 2018 at 19:30
  • Click Generate WSDL and give that to the other system. It should contain authentication information.
    – DavidSchach
    Commented Mar 13, 2018 at 19:38
  • really? in the wsdl generated by the apex class? I have not seen any login action and from soap ui I directly insert the session id retrieved using the login method of the enterprise wsdl
    – Pericle Parquet
    Commented Mar 13, 2018 at 19:43
0

Once the external caller is authenticated to Salesforce, their privileges are based upon the profiles and permission sets of the user under whose credentials they authenticated.

You secure integrations by locking down user permissions to only the minimum of functionality required by the integration user, not by manipulation of the exposed WSDL. Remember that an authenticated user could always connect to the REST API too, since they have valid credentials.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .