During sandbox creation or refresh (Enterprise, not ISV use case), with Apex class implementing
SandboxPostCopy, invoke MetadataAPI to delete stuff that shouldn't be in the sandbox (like Production Named Credentials)
While Apex can make callouts to the same org including the Metadata API, one needs a sessionId.
- Sandbox creation/refresh execute as Automated Process user
- UserInfo.getSessionId() as of Winter 19 returns a valid sessionId in async scenarios but not if the running user is Automated Process
- Publishing a Platform Event and consuming with a Trigger to do the callout won't work because Platform Event subscribers are Automated Process user. Same issue if I launched a scheduled class.
- Org is not using MyDomain (yet)
- Any Remote Site Settings inherited by the sandbox from PROD will point at PROD
I can't quite get my head around something to configure in PROD that gets copied into the sandbox during sandbox creation and that Apex would have access to and thus be able to do a callout to the same org without a sessionId that would
- point at
- be secure