Tell me more ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.
up vote 1 down vote favorite

We have a flow in our org that accesses a few custom objects (create,update). These objects are not accessible to most profiles, and when those profiles try to run the flow it fails since they don't have access to the object. Is it possible to have the flow run as a more privileged user or does that break the current SF security model?

share|improve this question

2 Answers

up vote 3 down vote

You can call an Apex plug-in from the flow: http://www.salesforce.com/us/developer/docs/apexcode/Content/apex_process_plugin_using.htm

You could run this plug-in without sharing to allow the user to insert/update objects that they do not have access to. Write the plug-in to accept as input all parameters needed to perform the inserts and updates. Then in the apex plug-in you can insert or update records based on your requirements and return the object IDs or errors that returned from your DML operations.

I believe this is the only solution that will keep a pretty tight lock on your security.

share|improve this answer
up vote 1 down vote

Presuming you do not want to update your security model to give visual access (Tabs, Related Lists, etc.) to these users.

  • Give the user profile read/update/create access to the objects accessed by the flow
  • DO NOT give the user profile access to the tabs associates with the objects
  • Create page layouts that do not include related lists/lookups associated with the objects

This would give the user the ability to access the flow in question, from a home page link or button, but they would not be able to see any of the records associated to the flow in tabs, list views, etc.

The fields and objects would essentially still be available through reports and dashboards presuming the user has report/dashboard folder access.

share|improve this answer
Anybody who's API enabled can of course use the API to update these records at will, and anybody who's sufficiently crafty to know salesforce's URL structure will be able to get to the data anyways. The level of security afforded here is by no means air tight, but it would work for users you trust not to be "bad". – ca_peterson Oct 19 '12 at 22:03
yeah, I have already done this, my question was about whether there was any easier way of doing this by having the flow run as a more privileged user. Thanks guys! – akarnid Oct 22 '12 at 8:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.