How to retrieve Apex 'webservice' WSDL using oauth access token?

Question

My Connected App authenticates using the OAuth 2 Username/password flow, which gives an "access_token" that I can use for authenticating REST queries via the "Authorization" HTTP header as a bearer token.

I have an apex class declared 'webservice' that I would like to call from my app. To do so, I need to download the WSDL and make a SOAP call to the class. Unfortunately, the customer would like to be able to update the class (which would invalidate the WSDL). Therefore, my app must be able to download the WSDL dynamically (and I can't just download it once and save it in my source code).

I'm having trouble correctly authenticating to download the WSDL. The URL I am using is:

https://<instance_url>/services/wsdl/class/ClassName

I have tried the following, and each time receive a response (200 OK) with a javascript redirect to login.salesforce.com:

1. adding HTTP header "Authorization: Bearer " like I do for REST requests.
2. Adding cookie "sid=" because apparently the "access token" is a valid "session id" (see https://stackoverflow.com/a/46975117/315936)
3. Adding GET parameter "oauth_token=" or "access_token=" (see https://help.salesforce.com/articleView?id=remoteaccess_using_access_token.htm&type=5)

It is possible I made a mistake trying one of those, but I don't think I did.

Searching github and the salesforce documentation, I have not found an example to reference for how to access this resource.

I thought I had a problem with my OAuth scopes, but unfortunately, the salesforce documentation for the username/password flow says:

This flow does not support including scopes in the request, and the access token returned from this flow does not get scopes.

Which seems kind of misleading, because according to the scopes documentation I should at least need the api scope for some of the other API calls I'm making. As far as I can tell though, there is no way to ask salesforce what scopes your current token has.

So, the question is: What is the correct way for me to access the WSDL resource for custom Apex dynamically? Do I need to user a different authorization method? Do I need to use a different login method?

Answer 1

I don't have an org at hand to test with an Apex webservice class, but I think this pattern will avail you.

What I typically do is use a session cookie store and start with a request to

https://myinstance.salesforce.com/secur/frontdoor.jsp?sid=<my access token>

Salesforce then creates all the cookies that are required for further HTTP requests to go through (as opposed to requests to the REST API that use regular Authorization: Bearer XXXXX headers).

In Python, it would look something like this:

import requests
session = requests.Session()
session.get(
    "https://{}.salesforce.com/secur/frontdoor.jsp?sid={}".format(
        my_instance, my_access_token
    )
)
response = session.get(
    "https://{}.salesforce.com/services/wsdl/class/ClassName".format(my_instance)
)