Is it possible to programmatically change connectedApp settings in production?

Question

Background: I have a requirement to make it so that an SFDC connected app defaults/is super easy to set to Admin Users are Pre-authorized instead of All users may self-authorize. This setting is important to make this app work and we have historically have had problems with admins not configuring this setting correctly.

Here is a quick history on what I have tried to do to get the isAdminApproved set to "true":

1. Directly, via xml definition (doesn't get honored)
2. Directly via apex code (doesn't get honored)
3. Indirectly via an apex-triggered metadata API call (ended up being more pain than what it was worth and was told that it wouldn't work in prod because of security restrictions)
4. Indirectly via a connected-app connected service to make a metadata API call: works in a scratch org but not in prod, which I assume is because it is a managed package. This would occur when an Admin clicks on a button, not from a post-install script.

Details on what I mean by it isn't working in prod: When I try to do a readMetadata call on my connectedApp objects that are in my managed package, the response comes back as [{\n 'fullName': None\n}] instead of with the metadata configuration of my connected app.

Here is a sequence diagram of what I am trying to do in #4 right now:

My question is this: Am I on a fool's errand, where this is impossible to do? ...Or is there a way to set a connected app (in a managed package that I publish) to Admin Users are Pre-authorized without making the admin just do it themselves directly in the settings?

Answer 1

In short, yes, you're on a fool's errand.

The general rule is that you can't package any settings that would allow granting 'system' permissions. That is, permissions that affect more than just the objects/schema that your package contains.

For example, you can't package CRUD/FLS on Standard Objects and you can't grant System Permissions like ModifyAllData via a Profile or Perm Set that you package. Similarly, any Remote Site Setting that you package can only be deployed into the org in an 'inactive' state via push upgrade or the user needs to explicitly agree to activate it if they do an interactive install.

To your question about Connected Apps -- yes, we had the same problem with a Connected App we package for a Canvas app -- and yes, the admin of the org manually needs to flip the Admin Users are Pre-authorized setting.

You are headed down the right path to try to use the Metadata API either externally or from Apex. If you're using it from Apex, it will only work if the org has a My Domain setup and you're using their My Domain as the SOAP endpoint domain. If the org doesn't have My Domain enabled, you'll need to have the org create a Remote Site Setting for their org's URL (ex. na5.salesforce.com) and you can see how convoluted this could become :-)