Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

I am getting the error INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, insufficient access rights on cross-reference id: []

Scenario is, I am inserting an Opportunity and then Opportunity Line Item from a Visualforce page using controller. When I am doing this I am logged in as user whose profile license is "Authenticated Website".

Strange thing is, when on another org logged in as user whose user profile license is Customer Portal Manager the same code work fine. Both orgs have Opportunity OWD "Read Only" and Opportunity line item "Controlled By Parent".

To resolve this problem I've used "without sharing" on class which executes the insertion code, and it works fine from "Authenticated Website" user. As this may be a security issue when we try to list the app on AppExchange, is there any other way to resolve this problem?

share|improve this question
    
Can you check the Object access for the Profile.Also not a bad idea that you make modify all once for testing to confirm that its security error. blog.daksatech.com/2012/10/… This blog may help you to figure . –  Mohith Kumar Dec 18 '12 at 14:32
    
If you have record types on the Opportunity or Line Items - check that user's profile has access to them. This will be enforced even for SysAdmins, even in "without sharing" and I've wasted good few couple of hours hunting for it :) –  eyescream Dec 18 '12 at 14:37
2  
Is the Opportunity related to an Account that the user has access to? –  Daniel Hoechst Dec 18 '12 at 16:23
    
MohithKumar: I think we don't have option to give rights to opportunity/Line item on Authenticated Website licensed profile. eyescream Record type should not be role in this scenario as using without sharing his code is working fine. @DanielHoechst Ditto! That can be the cause. TopicCreator: Please check if can set the OWD or permissions for opp/lineitem and check what DanielHoechst is suggesting. –  Forceguru Dec 18 '12 at 17:00
1  
Isn't there a restriction on what Standard Objects you can access with that License type? I thought it was custom objects only. This could be the issue. The restriction on objects may be enforced with Sharing rules so the with/without sharing scenario fits this situation. –  Kevin O'Hara Dec 18 '12 at 21:01
show 1 more comment

2 Answers

According to the license documentation:

http://login.salesforce.com/help/doc/en/users_understanding_license_types.htm

"Users with this license have read and create access on ideas and questions and answers, and read-only access to documents, knowledge, price books, and products" - plus you can access custom objects.

I'm surprised that you can insert an opportunity with a customer portal user, as the docs say that this functionality should only be available for Partner Portal users. That said, I have found that I do have capabilities that I shouldn't have with Authenticated Website Licenses, but I avoid using these in production in case its down to a bug that gets fixed and thus breaks my code.

Without sharing means that the code will run in the context of a system user, disregarding permissions and sharing rules associated with the currently logged in user. However, I'd expect the license type of the logged in user to be retained through the life of the transaction - it has been in similar situations I've found.

Given that what you are trying to do shouldn't be allowed through the license type, I'd be quite nervous about putting this out on the app exchange for a couple of reasons in addition to the security review:

  1. Anyone installing the package could technically be in breach of their license agreement
  2. If you are relying on a loophole/bug and that gets closed, your package will suddenly stop working with no warning.

At the very least I'd make sure that the end users understood that I was providing functionality that the license shouldn't support.

share|improve this answer
    
When I edit a custom profile with the HVCP or Authenticated Website User License the object permission checkboxes are unavailable for the permissions that are unavailable for the license, however I assume that they still exist. I'd expect Visualforce pages, standard pages, and with sharing Apex to honor that, but the Apex that runs without sharing to not since the without sharing docs state that the permissions and FLS are ignored for without sharing. –  Peter Knolle Dec 19 '12 at 9:41
1  
There is also enforcement at various levels that the user's license type allows the functionality - I've certainly hit exceptions reporting this before in without sharing code. Otherwise it would allow access to all functionality for the cheapest license as long as you are prepared to write some apex. –  Bob Buzzard Dec 19 '12 at 9:50
    
Thanks Bob (and thanks for the great answer). I had been thinking more abstractly of a situation where a single related field gets updated or a value is needed in the controller to make some sort of controlling decisions, but what you said definitely makes sense. –  Peter Knolle Dec 19 '12 at 23:43
    
Bob has the right answer here. I'll add color to that answer by saying that without sharing is only allowed through security review in very rare circumstances. –  greenstork Sep 24 '13 at 14:10
add comment

This error was causing a lot of pain in a Salesforce integration that we have. It seems like a permissions issue on first look. But it's sort of misleading. Even a System Administrator can get this error.

So after researching a lot, this was what I found:

The error is throw when you try to insert/update something that logically cannot be inserted/updated.

Some examples:

  • You try to update a record that does not exist. Maybe the record was never there or it was deleted.

  • You try to update an object field that cannot be set explicitly. These fields can only be updated by the implicetly. eg: object owner, CreatedById, CreatedDate, LastActivityDate, LastModifiedById, LastModifiedDate. You cannot explicitly update these fields.

  • You are trying to give permission to someone but you yourself do not have permission for this.

  • If you are trying to share "Record X" with "User Y" and you yourself do not have access to "Record x", this error happens Or if the "User Y" already has access to it.

These are just a few reasons you can get the salesforce error INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY; I am sure there are others.

Source: http://blog.daksatech.com/2012/10/salesforce-error-insufficientaccessoncr.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.