CLI should remove consumer keys in connected app meta files

[mcarvin8]

https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_connectedapp.htm

In order to deploy connected apps using the Salesforce CLI, you have to delete the consumer key line manually or else the deployment will fail because the key is unique in each org until you do a refresh.

I had to write a custom script to automatically delete the consumer key lines in every consumer app meta file before starting a deployment with connected apps. This works to deploy apps to multiple orgs with the other settings the same (previously I just had to instruct our developers to manually delete the line after retrieval).

The Salesforce CLI should be updated to not include the consumer key when retrieving connected apps from an org so the files will be deployable automatically after retrieval.

[VivekMChawla]

@mcarvin8 - Thanks for posting this suggestion. I have a couple of questions and a suggestion.

1. Is it conceivable that some users would want to retrieve the consumer key?
2. Would it be better to ignore the consumer key on deployment, instead of not including it when retrieving connected apps from an org?
3. Have you considered using the string replacement capabilities of the CLI to strip the consumerKey XML node on deployment? (thanks @WillieRuemmele for this suggestion!)

[daveespo]

I think @pkozuchowski 's suggestion of removing the Consumer Key XML element from your project/repo is the right approach here.

Having the CLI do black magic and omit Consumer Key on deployment would give a casual observer the impression that the Consumer Key in your repo is the one that is in your scratch org. That's not a great surprise to stumble upon after a few hours of troubleshooting.

I acknowledge that a retrieve would end up restoring the Consumer Key in your local project so it just requires vigilance to review what you're planning to commit.

[aheber]

As far as I can remember pulling this file is the only way to retrieve that value.

In the past I have needed to know that value so I can use that new connected app to communicate with the org.

I wouldn't want to lose the ability to access that value, I would be OK if that behavior were managed with an environment variable. I just don't want it to become inaccessible.

[pkozuchowski]

@aheber You can check consumer key and secret from the UI.

[aheber]

I'm sorry I wasn't clear, I'm talking about a headless & automated environment. The API doesn't provide another mechanism.

[pkozuchowski]

@aheber Oh yes, that's actually very good topic! Commands for headless rotation of secrets and certificates would be great