0

I am trying to get (custom, Apex-based) REST API access for a (lightning) community user but keep hitting an error around access to the REST API's apex implementation. The specific error is:

You do not have access to the Apex class named: MyClass

I have tried researching why the errors I see might be happening, but none of the results I've found required me to do anything I haven't already done.

My setup is as follows:

The community user is using a Community User Plus license and I have cloned the standard Customer Community Plus User profile to add the following:

  1. Apex REST Services (System Permission)
  2. API Enabled (System Permission)
  3. The required Apex classes implementing the REST API, here namespace.MyClass (Apex Class Access)

This profile is associated with the community itself and is assigned to the community user.

I have a valid Connected App that includes the "api", "web" and "refresh_token" scopes and I can successfully perform the OAuth 2 flow to obtain the required authentication token against the community using something like (split for readability):

https://community-url/services/oauth2/authorize?response_type=token&
    scope=api+web+refresh_token&
    client_id=3MVG.client.id.A9i6&
    redirect_uri=myauth:/success&
    display=touch&
    prompt=login&
    login_hint=my.user%40example.com

Having successfully obtained the access token I am then trying to use this with a simple HTTP GET against:

https://community-url/services/apexrest/namespace/url-mapped-path-to-apex

(The token is passed in the Authorization header, with a value of the form "Bearer the-access-token".)

However, in doing this I am getting an HTTP 403 error with detail like:

{
  "errorCode": "FORBIDDEN",
  "message": "You do not have access to the Apex class named: MyClass"
}

(I note that the error doesn't cite the namespace in which the REST API class exists.)

Have I missed something? Are there other required permissions? Do I need to also provide explicit access to other Apex classes used by the REST API implementation?

6
  • You only need to give access to the entry point REST API class. Do turn debug logging on for both the Site Guest user and the Community user: where the logging goes indicates which user is in use.
    – Keith C
    Dec 1 '20 at 12:44
  • @KeithC, Sorry, I should have said I'm using a Lightning Community. I'll update the question.
    – Phil W
    Dec 1 '20 at 13:20
  • I'll set up debug logs for the community user and see what's what.
    – Phil W
    Dec 1 '20 at 13:21
  • OK, so having done that I get no debug logs created for the community user I'm using. So, like you suggest, it seems somehow the requests are being associated with a different user. I'll investigate the config for the community and let you know :)
    – Phil W
    Dec 1 '20 at 13:24
  • Nothing obvious there. Not sure how guest users are able to access a Lightning Community at this point. I have no Sites though My Domain is set up. Any other suggestions?
    – Phil W
    Dec 1 '20 at 13:31
0

When I was performing the OAuth2 flow I did this initially through a browser by directly hitting the form of URL I put in the question. Importantly note that I tried to define the scope as "api", "web" and "refresh_token" (using "+" to represent a space in the encoded URL). This was fine because I had a custom scheme in the redirect_uri). This gave me back a token, indeed it gave me back various other values including the refresh token.

I was then using the access token obtained through the browser within the ARC (Advanced REST Client) tool in order to hit the REST API and this didn't work.

I subsequently moved the OAuth2 flow handling into ARC. In doing so, ARC specifies what the redirect_uri is, and this time it uses a standard scheme. That then meant that authentication failed (not sure exactly what happens but ARC reports "Unable to run authorization flow. Make sure the OAuth2 config is valid"). Removing "refresh_token" resolved this problem.

Once the OAuth2 flow was successfully run in ARC, ARC would then successfully invoke the REST APIs.

I can only guess that, whilst I was getting an apparently valid access token in the separate execution of the OAuth2 flow via a browser, this wasn't actually usable against the REST APIs in the community.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.