Salesforce user security is an intersection of sharing, user, Profiles, roles, roles hierarchy and object permissions.

learn more… | top users | synonyms

1
vote
2answers
22 views

Unable to redirect a page from Visualforce

I'm currently making a custom editor in Visualforce that adds things to a related list. Things from this list are selected and then when the "add packages" button is click it should make the records, ...
8
votes
1answer
260 views

Does Salesforce have an Antivirus feature?

Is there any way to integrate Antivirus in Salesforce, or does this already exist? Additionally, I would like to also have realtime URL scanning of malicious HTML documents and websites. Key ...
1
vote
1answer
16 views

Trying to find information on security for Files attached to Activities. Can you separate it out?

I'm struggling somewhat to find anything on the File Attachment related list in Activities. What I am hoping is to be able to limit who can see/download the file and remove it from being searchable. ...
0
votes
1answer
13 views

How to I prevent a object(standard as well as custom) records(all) to be displayed in global search? [duplicate]

For E.g. Do not allow search results to display for Accounts records
1
vote
0answers
34 views

Why might a certificate import fail, when uploading a certificate not created from a Salesforce-generated Certificate Signing Request?

I've been given two X509 certificates to upload into an org for use in SSO (one for signing, one for decrypting), but I can't seem to upload either of them successfully. As I've been given the ...
1
vote
1answer
17 views

How to serve a Site.com site using HTTPS?

We would like to use a custom HTTPS certificate to serve a new site.com site via the HTTPS scheme. How to implement this in Site.com? I believe the Fall 2014 release added this capability, but I ...
1
vote
0answers
22 views

Login using javascript remoting

we are trying to use AngularJS as a framework for a community site. Problem is that the first page is accessible as a guest user. All required remote action calls are public. At a certain point, the ...
1
vote
2answers
54 views

How to restrict a user's access for accounts they do not own

I have a roles hierarchy like in the image attached. One Sales Manager and UNDER this role, two other roles: Sales_Europe and Sales_US. Assigned to these two roles, i have two users: user_a (Role: ...
0
votes
0answers
28 views

insufficient privilege on changing opportunity owner despite sharing rule

Hi i have our OWD setup for Opportunity object = Private then we have this sharing rule: Owner in Role: Sales Manager shared with owner in Role:Sales Rep (Read/Write) now our Sales Manager created ...
0
votes
0answers
8 views

Can't see all users' ContentVersion rows in Workbench

Following query is useful to me, to see which files have been uploaded to Salesforce. This query only shows rows that have actually been created by the user who is logged into workbench and running ...
0
votes
1answer
12 views

how to hide a record in hierarchy model salesforce

I have a hierarchy model where 1 manager with 2 leads officer (A, B) and 2 sales person under each lead officer. Now my client need to hide records of A lead officer from manager. How can it be ...
1
vote
0answers
24 views

Custom Component visible in Sandbox but not in Production

I created a few custom components to use in two different email templates (they all use the same controller class) and everything is working as it should at the Sandbox. But when I deployed it in ...
2
votes
2answers
84 views

Why Salesforce oAuth Username Password flow does not need security token?

While using SOAP API login call we need security token or the public IP should be whit listed. Why not when we use connected APP Username Password flow? If you compare security token implementation ...
0
votes
0answers
26 views

API access security in salesforce

I have batch class which fetch data from API url & insert that data into salesforce. Our other team which is working on API from other side they need to set security so that only our saleforce ...
1
vote
2answers
32 views

Developer Console security

Context: We have multiple Business Admins in different countries, who can only see records from their market in Salesforce. Now, we're considering giving these Business Admins access to the Developer ...
3
votes
1answer
47 views

SFDC European Data Center experiences

I see a new EU5 instance on trust.salesforce.com which has a 'LON' hovertext over it, assumingly referring to London. I can imagine some companies might be interested in having their data hosted in ...
0
votes
0answers
30 views

Custom Domain with Connected App for Branding restricting login for other org users

I am building a hybrid mobile app using SalesforceMobileSDK-iOS & Cordova. I want have custom branding on the login screen of the app. I have created a connected App with all possible permissions ...
0
votes
0answers
17 views

how to report on who has access to pricebooks

I need to be able to see who and what roles and subords have access to what pricebooks, e.g., active pricebooks, is there a way to do this?
1
vote
1answer
70 views

What could be the situation - Record Currently Unavailable- Record Lock Issue

One of user from my org got this error while changing an owner of Account. (there is a trigger on Account who updates its child opportunities too ) Now I am unable regenerate the error. So my ...
0
votes
0answers
33 views

How to audit membership change events? (roles & groups)

We are developing a Security Audit solution for Salesforce, I can easily find how to query for the current state of role hierarchy, group membership etc. But I can't seem to find how to audit ...
6
votes
1answer
50 views

How are Master Encryption Keys being stored?

What storage methods does Salesforce use to store Master Encryption Keys? For example, are the master keys stored in some type of secure key store? If so, what methods does it use to ensure the keys ...
0
votes
1answer
14 views

Why is the Add Google Docs button hidden on some SObjects for same user?

We have Google apps activated. I have a user, which can add Google docs to leads/Accounts/Oppty/etc... But when he goes to Campaign page - the buttons are missing. I only have 1 page layout ...
0
votes
1answer
35 views

Restricting record level access in role hierarchy

If i set the OWD for Account as private and if i create a public group and add some users into that and create a sharing rule for giving read and write access to that public group then managers of the ...
2
votes
2answers
49 views

Provide read to few users and read / write to all users on a new sObject when all users have same profile permissions

We have about 108 users in out application who need to be able to have read / write access on an special sObject and do other lots of things. There are two user who need to do the same other lots of ...
1
vote
0answers
34 views

Salesforce Security Review documentation

I want to know if their is any proper documentation format that I have to follow for security review. I have searched for the document format and got this link ...
2
votes
1answer
44 views

checking FLS in triggers

I've seen loads of code examples of triggers and helper classes. They never check for object or field level permissions. I wonder if this was done for code clarity or is this something one does ...
-1
votes
1answer
27 views

Salesforce Security Review?

i have used the burp tool but i think it doesent suit for my requirements.. can i know what are the different parammeters on which code is being reviewed apart from governor limits and sharing ...
0
votes
0answers
31 views

Issues on a LIST button

I have a list button that on clicking take me to page /apex/abc . In that page I have a input field called account : order__c.account__c that is a master detail child to Accounts and a button. My ...
0
votes
1answer
22 views

salesforce Org and group level security

A company has 2 franchises, both of which are a part of the same Salesforce org. The CEO manages both franchises, and should be able to see and communicate with all users. The CEO further needs to ...
0
votes
2answers
33 views

Visualforcepage security

I have a custom profile named Marketing Team and the assigned user is Sujal. In that profile, i enabled one visualforce page access to him. So accordingly, Sujal can now access that VF page. I have ...
0
votes
1answer
27 views

Show Inactive Product records to user who does not have edit access

Is there a way to show inactive products to user who does not have edit access to same ? I could have given edit access to products on user's profile but then they will also have access to ...
2
votes
2answers
77 views

When do we need to use Apex Class permissions

My colleague and I were reviewing the Apex Class Security Overview. Per our understanding of the page, if a user does not have permission to access VisualForce page's controller, he should not be ...
1
vote
0answers
19 views

Provide limited shared access to objects

I'm working on a system integrating Infor LN and Salesforce using the Inforce app. All SF records sync'd with LN are of an Inforce Account Record Type. The accounts have the usual CRM features plus ...
2
votes
1answer
55 views

Are private fields visible through related list of a related (public) object?

I created two objects ObjectVisible and ObjectHide. ObjectVisible has lookup fields to ObjectHide. I set the OWD as follows: ObjectVisible: Public Read, ObjectHide: Private I used custom code to ...
1
vote
1answer
121 views

How to secure Web Service API integration with external systems

I am given few URLs (web service APIs), which when called would fetch and display data in JSON format and I am using these in my Salesforce Org and use them to update few of Salesforce fields. I have ...
0
votes
1answer
67 views

How can I set field level security for multiple fields in the same custom object?

I have deployed several objects from one sandbox environment to another. I notice that the field level security settings has not been deployed. I used the change sets method to deploy these objects. ...
3
votes
1answer
103 views

VF Page Custom Console Component blocked due to Same Origin Policy

I have a custom Visual Force page and use it as a custom console component in the Service Console. It was working but not it's being blocked due to the same origin policy: Uncaught SecurityError: ...
0
votes
1answer
38 views

Contact's child records transfer

I have few custom child objects (lookup relationship) of Contact. My requirement is if I change the Contact owner from User A to User B, I want the child records of that Contact to be transferred to ...
1
vote
0answers
34 views

Accessing Salesforce session via oAuth maintains session across browsers

I am using oAuth 2.0 Web server flow to connect to Salesforce org and get the Access token and refresh token. I use the following URL to access a visualforce page that resides within the Salesforce ...
1
vote
1answer
57 views

How best to secure client_id + secret using - Rails + Restforce

I've successfully managed to set up an app using my developer account - it is currently making use of Ruby on Rails 4.2.beta2, ejholmes most excellent gem restforce and the very helpful tutorial and ...
2
votes
1answer
99 views

Safest way to see if a user is still “logged in” (REST API)

I'm using the Salesforce REST API along with OAuth 2.0 User-Agent Flow. I have the need to "ping" Salesforce to see if a user is logged on (this is the simplest way to do so in my application). If the ...
1
vote
1answer
137 views

Error : Insert Failed :INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, Sharing Rule Trigger

I have created one Trigger to give access to particular Accounts of my "Special" custom object records, Here BBB : Is custom object having lookup of both Account and Special E.g. BBBRecord = ( ...
4
votes
1answer
56 views

Is DATABASEDOTCOM Ruby gem affected by SFDC dropping SSL3.0 support?

SFDC recently stated they will not support SSL3.0 any longer. Notification goes on to say currently supported browsers all use TLS by default so the users are safe. My concern is an external ruby ...
6
votes
2answers
245 views

Is encrypting passwords in protected custom settings a security requirement?

Regarding the Salesforce security review process, can anyone confirm (or deny) that storing a connection URL, username and password for a webservice utilized by an appexchange app can be done in plain ...
2
votes
1answer
55 views

I created a custom object, and fellow admins cannot see my data

I'm part of the System Administrator role/profile. I created a custom object and added some data to it. Other system admins created data as well. When creating the object, we assign ourselves as the ...
4
votes
1answer
75 views

Is login history only stored for 6 months?

Is login history only stored for 6 months? I appreciate it's in the security audit controls workbook: Because of the volume of data, login history is automatically removed after six months. If you ...
1
vote
3answers
172 views

Field level security and API access

Could someone please explain how both of the following two statements are correct: A field hidden by field level security is not visible through the API. A user has not been granted field-level ...
2
votes
1answer
41 views

'Workflow' to resubmit package to security review with corrections

I had a technical question and wanted it to review it with you to make sure that I am following the right approach: To submit the package for security review, I do the following steps: I get the ...
2
votes
1answer
377 views

Critical Update “Serve Static Resources from the Visualforce Domain” still serves resources via Salesforce Domain

After activating the Critical Update, I checked a couple of my orgs using Managed Packages which provide resources used on buttons and scripts in the Standard Salesforce domain. It surprised me that ...
3
votes
1answer
54 views

Display unsecured Intranet pages in SF

I have company intranet pages are insecure webpages , and I want to make them accessible by a tab. From what I understand, you can only put secure pages on tabs. Can someone recommend a work around? ...