I have a permission set that has connected apps assigned, but I am unable to view them when I pull down the metadata. I've tried using MavensMate and ANT. Is there something I'm missing?
I wondered if this item in the Summer '17 release notes held a clue:
In API version 40.0 and later, when you retrieve permission set metadata, all content exposed in Metadata API for the permission sets are retrieved. Retrieval includes Apex associated with the permission set, CRUD, and so on. In API version 39.0 and earlier, retrieving permission set metadata returns only the app and system permissions assigned to the permission set. Junction metadata (such as Apex, CRUD) are included only if the metadata for the related component is also included in the package definition.
This does not explicitly state that the junction object between Connected App and Permission set is exposed in the Metadata API. I tried to retrieve PermissionSet and ConnectedApplication to see what metadata came back, using this package.xml file:
<?xml version="1.0" encoding="UTF-8"?> <Package xmlns="http://soap.sforce.com/2006/04/metadata"> <types> <members>*</members> <name>PermissionSet</name> </types> <types> <members>*</members> <name>ConnectedApplication</name> </types> <version>40.0</version> </Package>
In PermissionSet, the object, system and user permissions were returned, but not junctions to a connected app. Oddly, the Metadata API returned "Entity type: 'ConnectedApplication' is unknown," which surprises me given the release notes.
I have established that PermissionSetAssignment does not serve as the junction object between PermissionSet and ConnectedApp (as it does for users). I did this by running a SOQL query like this against a connected app known to have a permission set assigned to it:
SELECT Id,PermissionSetId, PermissionSet.Name FROM PermissionSetAssignment WHERE AssigneeId = '[ID of connected app]'
This query returned no results.