Restrict access to specific fields when using Salesforce Integration User Licence on Standard objects (like Contacts)

Question

By default, the Salesforce Integration User Licence doesn't provide access to a variety of standard objects (including Contacts and Accounts).

You can extend the access for an integration to those objects by using the Salesforce Integration API Permission Set License AND a custom permission set, as helpfully explained in accepted answer to this question.

Essentially:

1. Create a user with the Salesforce Integration User Licence,
2. Apply the Salesforce API Only System Integrations profile,
3. Assign the Salesforce API Integration Permission Set Licence, then
4. Create a licence independent permission set that grants (READ, Object-Level) access to those objects.

This is all explained in the above question.

The problem is that the permission set created in step 4, had no field level access - BUT when testing, the integration user has read access to ALL the fields on the object.

Using Salesforce's User Access & Permission Assistant permission explorer, you can see that the object level access is granted by the Permission Set but the field level access is granted from the Profile (which you can't view or remove).

Is there any way you can use the Salesforce Integration User Licence while restricting access to specific fields?

(I've considered masking field level access with permission set groups, but there must be a simpler way?!)

Answer 1

If you modify the Salesforce API Only System Integrations profile the normal way - through Setup in the Salesforce UI, you can't set field level permissions for some of the standard objects (like Contacts).

However, these permissions can still exist on the profile.

If the profile does explicitly set read or edit rights for field (but not the object), but a permission set that grants object level access is also applied - then those fields will become available. This is what happened in my case.

While you can't fix this via the UI, you can use the Salesforce CLI (using the approach described by @kai-tribble in this answer), to retrieve the profile metadata xml - with the field permissions that exist on the profile, but can't be viewed or edited via the GUI.

The manifest file (package.xml) must contain the profile AND the objects/custom fields for which the profile references e.g.

<types>
    <members>*</members>
    <name>CustomField</name>
</types>
<types>
    <members>*</members>
    <name>Profile</name>
</types>

This will retrieve profile xml which will contain all the fields that were not visible in the GUI, looking something like this:

<fieldPermissions>
    <editable>false</editable>
    <field>CustomObject__c.CustomField__c</field>
    <readable>true</readable>
</fieldPermissions>

You can then modify the fields in the XML (set to true/false) and the push/deploy the XML back into the salesforce instance.

I highly recommend using the Salesforce Permission Set Explorer for diagnosing this kind of issue.