2

Background: I have a requirement to make it so that an SFDC connected app defaults/is super easy to set to Admin Users are Pre-authorized instead of All users may self-authorize. This setting is important to make this app work and we have historically have had problems with admins not configuring this setting correctly.

Here is a quick history on what I have tried to do to get the isAdminApproved set to "true":

  1. Directly, via xml definition (doesn't get honored)
  2. Directly via apex code (doesn't get honored)
  3. Indirectly via an apex-triggered metadata API call (ended up being more pain than what it was worth and was told that it wouldn't work in prod because of security restrictions)
  4. Indirectly via a connected-app connected service to make a metadata API call: works in a scratch org but not in prod, which I assume is because it is a managed package. This would occur when an Admin clicks on a button, not from a post-install script.

Details on what I mean by it isn't working in prod: When I try to do a readMetadata call on my connectedApp objects that are in my managed package, the response comes back as [{\n 'fullName': None\n}] instead of with the metadata configuration of my connected app.

Here is a sequence diagram of what I am trying to do in #4 right now:

Flow that I got working in a scratch org

My question is this: Am I on a fool's errand, where this is impossible to do? ...Or is there a way to set a connected app (in a managed package that I publish) to Admin Users are Pre-authorized without making the admin just do it themselves directly in the settings?

  • 1
    When you say it doesn't work in Prod, could you be more precise? Is it a silent failure or a specific error message? Also in your other post you dump some code that you call a "post-install script"... but post install scripts run as a package specific automated user who has no Session ID so I don't understand how that code could work in any org at all as an InstallHandler. On the other hand it might work from a Visualforce button that the admin clicks during setup. – Charles T Nov 28 '19 at 1:32
  • @CharlesT Thank you for your comment. 1) I just edited my question to be more precise. 2) You are right, I had intended on the admin clicking on a button. I edited my question to be more clear there as well. – Robert Hyatt Nov 28 '19 at 1:42
3

In short, yes, you're on a fool's errand.

The general rule is that you can't package any settings that would allow granting 'system' permissions. That is, permissions that affect more than just the objects/schema that your package contains.

For example, you can't package CRUD/FLS on Standard Objects and you can't grant System Permissions like ModifyAllData via a Profile or Perm Set that you package. Similarly, any Remote Site Setting that you package can only be deployed into the org in an 'inactive' state via push upgrade or the user needs to explicitly agree to activate it if they do an interactive install.

To your question about Connected Apps -- yes, we had the same problem with a Connected App we package for a Canvas app -- and yes, the admin of the org manually needs to flip the Admin Users are Pre-authorized setting.

You are headed down the right path to try to use the Metadata API either externally or from Apex. If you're using it from Apex, it will only work if the org has a My Domain setup and you're using their My Domain as the SOAP endpoint domain. If the org doesn't have My Domain enabled, you'll need to have the org create a Remote Site Setting for their org's URL (ex. na5.salesforce.com) and you can see how convoluted this could become :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.