System.CalloutException: Web service callout failed: WebService returned a SOAP Fault: INSUFFICIENT_ACCESS: use of the Metadata API requires a user with the ModifyAllData permission

[sfdcprs]

Hi Andrew,

I am facing below exception when I log in as non admins. It works well for Sysadmin.
System.CalloutException: Web service callout failed: WebService returned a SOAP Fault: INSUFFICIENT_ACCESS: use of the Metadata API requires a user with the ModifyAllData permission.

Apex runs in system mode how does Metadata API taking the permission of the user. Can you please help me in understanding this.

Thank you in advance.

[afawcett]

Yeah unfortunately this does not extend to the metadata API. More so that in effect these classes are making http callouts, so the web service does not really even know what language the caller is using. Some suggestions would be to use some kind of queue for the work read by a scheduled job. Or using a oAuth token obtained from a admin user.

[sfdcprs]

Thanks Andrew. I need the action to be performed immediately hence I cant use scheduled job. Do you have any sample code with oAuth?

[afawcett]

When you create the MetadataService you can set either a Session ID or an oAuth Token.

 MetadataService.MetadataPort service = new MetadataService.MetadataPort();
 service.SessionHeader = new MetadataService.SessionHeader_element();
 service.SessionHeader.sessionId = adminSessionIdOrOAuthToken; 

The answers on this StackExchange question gives you the details on how to obtain either a Session Id (see my answer) or an oAuth token (see Phil Hawthorns answer).

Note: The oAuth tokens are typically more persistent (you don't need to keep asking for them), as the idea is the admin can expire the callers access through the Connected App (which is your code in this context). However i am not 100% sure if this is true for the user name and password flow tbh.

[afawcett]

Do let me know how you get on with this. You should blog or tweet about it if you get it working, i know that others using this library would be interested. We could perhaps update the MetadataServiceExamples.cls as well?

[sfdcprs]

I am able to get the Oauth token using below.
Http h = new Http();
String body = 'grant_type=password';
body = body + '&client_id=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX';
body = body + '&client_secret=XXXXXXXXXXXXXXXXXXXXXXXX;
body = body + '&username=XXXXXXXXXXXXXXXXXXXXXXXXXX';
body = body + '&password=XXXXXXXXXXXXXX';
HttpRequest req = new HttpRequest();
req.setEndpoint('https://test.salesforce.com/services/oauth2/token');
req.setMethod('POST');
req.setBody(body);
System.Debug('Request Sent: ' + req);
HttpResponse res = h.send(req);
String oAuthReponse = res.getBody();
System.Debug('* oAuthReponse: ' + oAuthReponse);
OAuthTokenizer jsonWrapObj = (OAuthTokenizer)JSON.deserialize(oAuthReponse, OAuthTokenizer.class);
System.Debug('* Oauth token: ' + jsonWrapObj.access_token);

[sfdcprs]

But now my look out is to get List View Id using medata api. Though I am able to get columns, filters from readMetadata it still doesn't retrieve id. If you see getListViewOptions() of StandardSetController it provides id, label..... And in the workbench as well under "Metadata Types & Components" ==> "List Views" we are able to view id's.
Is there any way we can get the id of list view using metadata api?

[afawcett]

Excellent glad you got it working!

RE: ListView Id's. I think that might be using the listMetadata call? The FileProperties type returns the Id.

[sfdcprs]

Thanks Andrew. File Properties provides the id of the list view along with full name.It fetches list views from entire org on all objects. I have two questions on this

1. Since it returns the list metadata of entire org for the specified type do we have any governor limits as such using it in the apex?
2. Is there any workaround to specify the object for which we want to retrieve the ListMetadata like we specify the type ?

[afawcett]

The main limit would be the 3MB limit on callout response sizes and maybe timeout if Salesforce doesn't respond in time. I did have a look at the Tooling API btw, no joy with that. Can you use dynamcially create a StandardSetController in your use case?

[sivasank4sfdc]

Hi Andrew,
Hope you are doing great!

I've the below scenario, please give me your inputs on this,

I'm updating the CustomLabels as System administrator profile using VF page UI and I need to allow "Salesforce Platform" license profile users to update the custom labels using VF page. I have given the access to VF page, controller class and MetadataService class, but when I load VF page getting error as "WebService returned a SOAP Fault: INSUFFICIENT_ACCESS: use of the Metadata API requires a user with the ModifyAllData permission faultcode=sf:INSUFFICIENT_ACCESS faultactor=".

Is there any option to allow Salesforce Platform profile's users to update the Customlabels? please advise.

In case if we don't have option then I wish to try this as per below approach,
please advise will it work for my needs.

As @sfdcprs I'll write apex rest API to get the customlabels using autotoke (System Admin credentials) and implement the logic to update the custom labels.

Thanks in advance,
Sivasankar

[afawcett]

Sorry, its a requirement of the Salesforce Metadata API to have this, as its a very powerful API.

Yes you can use oAuth to have the admin authenticate that the code can use their access on behalf of the running user. But be very careful where you store this token. I would not recommend using the user/pass oAuth flow (as shown by @sfdcprs above) as you will need to store those some place for your code to read them which also presents a security risk of them being found. The web based oauth flow is unfortunately harder to implement and i don't have a clean example at hand.

Here is another thought.... why don't you stage the changes to the labels in a custom object, then have a job / page the admin user can run that processes them every now and again? Its not as elegant and realtime i know, but is a separate of responsibilities.

[azzaouimamine]

Hello,
You can use Named Credentials to store the Admin Credentials. It is available with OAuth2.0.
https://help.salesforce.com/articleView?id=named_credentials_about.htm&type=5
Amine

[Sivaranjanikannan05]

There was an unexpected error in your org which is preventing this assessment check from completing: System.CalloutException: Read timed out.
Please help me out i am struggling with thus error.