My Connected App authenticates using the OAuth 2 Username/password flow, which gives an "access_token" that I can use for authenticating REST queries via the "Authorization" HTTP header as a bearer token.
I have an apex class declared 'webservice' that I would like to call from my app. To do so, I need to download the WSDL and make a SOAP call to the class. Unfortunately, the customer would like to be able to update the class (which would invalidate the WSDL). Therefore, my app must be able to download the WSDL dynamically (and I can't just download it once and save it in my source code).
I'm having trouble correctly authenticating to download the WSDL. The URL I am using is:
https://<instance_url>/services/wsdl/class/ClassName
I have tried the following, and each time receive a response (200 OK) with a javascript redirect to login.salesforce.com:
- adding HTTP header "Authorization: Bearer " like I do for REST requests.
- Adding cookie "sid=" because apparently the "access token" is a valid "session id" (see https://stackoverflow.com/a/46975117/315936)
- Adding GET parameter "oauth_token=" or "access_token=" (see https://help.salesforce.com/articleView?id=remoteaccess_using_access_token.htm&type=5)
It is possible I made a mistake trying one of those, but I don't think I did.
Searching github and the salesforce documentation, I have not found an example to reference for how to access this resource.
I thought I had a problem with my OAuth scopes, but unfortunately, the salesforce documentation for the username/password flow says:
This flow does not support including scopes in the request, and the access token returned from this flow does not get scopes.
Which seems kind of misleading, because according to the scopes documentation I should at least need the api
scope for some of the other API calls I'm making. As far as I can tell though, there is no way to ask salesforce what scopes your current token has.
So, the question is: What is the correct way for me to access the WSDL resource for custom Apex dynamically? Do I need to user a different authorization method? Do I need to use a different login method?