I am using the latest v46 version of the Financial Force Metadata API Apex Wrapper to create a Connected App but the values I put in the code are partly ignored.

What is not working:

  1. ConnectedApp.permissionSetName (perm sets are in Managed Package)
  2. Set ConnectedAppOauthConfig.isAdminApproved = true

All expected Metadata objects are created with no errors.

   public override PageReference run() {

    return refresh();


private void createConnectedApp() {
    if(connectedApp.isEmpty() || Test.isRunningTest()) {
        MetadataService.ConnectedApp app = new MetadataService.ConnectedApp();
        app.fullName = SetupCtrl.DEV_NAME;
        app.label = SetupCtrl.DEV_NAME;
        app.contactEmail = UserInfo.getUserEmail();
        app.oauthConfig = oauthConfig();
        app.permissionSetName = new List<String>{ 'PackagedAdminPermSet' };// WONT WORK

        save(new List<MetadataService.Metadata>{ app });

private MetadataService.ConnectedAppOauthConfig oauthConfig() {
    MetadataService.ConnectedAppOauthConfig result = new MetadataService.ConnectedAppOauthConfig();
    result.isAdminApproved = true; // WONT WORK
    result.callbackUrl = 'http://localhost/callback';
    result.scopes = new List<String>{ 'Api', 'Web', 'RefreshToken', 'OpenID' };

    return result;
  • 2
    There have been issues with managing connected apps via Metadata API. Last we tried it they weren't resolved but perhaps someone else has succeeded. – identigral Aug 1 '19 at 22:16
  • Is that publicly documented somewhere or do you know a Salesforce pm who is responsible for this? – Robert Sösemann Aug 2 '19 at 6:15
  • 2
    Not aware of any KIs and they might have been resolved, it's tough to tell from the outside. The PMs read the Identity group on Trailblazer, post there and hopefully they'll respond. – identigral Aug 2 '19 at 6:21
  • 1
    I tried to retrieve metadata for the connected app using my IDE, it did not retrieve Idp certificate – Pranay Jaiswal Aug 5 '19 at 15:54
  • 1
    Wondering about that 'encryptionCertificate' assignment, the doc says 'The name of the certificate...' – Kevin Jones Aug 9 '19 at 10:13

I think the second problem you listed is causing the first problem, and unfortunately it's a bit of a layered answer. I'm also assuming that the MetadataService layer you've generated is all correct.

The first part to solve is getting the ConnectedAppOauthConfig.isAdminApproved = true. Now I couldn't get this to set on creation of the Connected App. However, when I update the Connected App just created with the setting of ConnectedAppOauthConfig.isAdminApproved = true it sticks. So you will need to create the Connected App first then update the same app to make the setting stick.

Now going back to the Connected App documentation, the 'permissionSetName' field requires the 'isAdminApproved' to be set to true so we can't set the permission sets on create. I was able to set unmanaged permission sets on the update, but got the following error when trying to set the managed package permission set:

Cannot modify managed object: entity=SetupEntityAccess, component=0J0O000000Ceu83, field=KeyPrefix, state=installed

The ConnectedAppPlugin class might be something you will need to explore as an authorisation alternative if you don't have control of the managed package setup.

  • I will grant the bounty to you and it would be nice if you take some time to find answers later. – Robert Sösemann Aug 9 '19 at 10:56
  • I added my full code and a list of what is not working so you see what I am doing. I think I am not missing required stuff as everything gets created. At least all Metadata objects are there. – Robert Sösemann Aug 9 '19 at 11:00
  • 1
    Hoping I got it now :D thank you for sharing that additional context as it definitely helps – Clint Aug 9 '19 at 14:01
  • I created my own MetadataService from the v46 WSDL, so thats not relevant. Would be great if you could try it with code and post that. Especially the linking of packaged perm sets is a mystery. – Robert Sösemann Aug 9 '19 at 14:49
  • Ahh bugger! Can you please share the code snippet for the OAuthConfig class to help round out the question for completeness? I'll need to try it with code tomorrow. Based on the documentation we will need to get the 'isAdminApproved' working first which is why I'm interested in the MetadataService you generated. – Clint Aug 9 '19 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.