2

I have a managed package that I have gone through the process to create Permission Sets and associate Custom Permissions to those Permission Sets. After much struggle I found that all of the components in that managed package are being enabled for all profiles, thus negating the point of creating a permission set with custom permissions. The profiles already have access to all the components upon installation of the package. I have looked through documentation but have not found where this can be managed in my package.

My question is how do I prevent all profiles from getting access by default. I do not create or otherwise assign permission to any profiles in any of the project metadata files (I don't believe) and am curious why all profiles gained access to my custom components/classes/permissions/etc by default upon installation of the package? How would I control this from my managed package?

1 Answer 1

3

I suspect this comes down to how the package has been installed.

When installing through the Setup UI (via the package version install URL) the admin is given three options:

  • Install for Admins
  • Install for All Users
  • Install for specific Profiles

Essentially each option selects a set of one or more profiles that get updated during Install. The updates relate to all new objects, fields or custom permissions contained in the package (compared with what is already installed on the org, if anything).

For each profile, read access granted for all objects and fields from the package, and each custom permission is granted too.

Note that you, as package developer, cannot influence this other that to tell the admin to avoid using All Users (which updates all profiles associated with active users on the org).

Also note, despite it not being documented, it doesn't matter the option selected by the admin after the first install of the package as the option chosen on first install applies against every subsequent upgrade.

4
  • That makes sense. I will test this in one of our production testing orgs. Given your explanation, I can have the Admin install it for Admins only since I give Admins full access to all components in the package anyway via their Permission Set. I would just need to confirm that the admin can assign selected users the Package_User Permission Set and provision the components to other users after install. Thanks for pointing me in the right direction. I will update the posting with results once tested.
    – bswartz
    Commented Aug 30 at 18:49
  • Just remember that final note - you need to do this right on first install.
    – Phil W
    Commented Aug 30 at 18:53
  • I confirmed with a clean install that this is exactly what is going on. I will have our customers clean up the errant permissions and now have a path to prevent on future new customer installs by either installing just for Admins (I want them to have full access anyway) or for a specific Profile that the keeper of our managed package on the customer side is assigned. Thank you very much for your insight. Much appreciated.
    – bswartz
    Commented Sep 3 at 15:23
  • Sounds like this answers your question. If so, please mark it as the best answer to close out the Q&A. Ta.
    – Phil W
    Commented Sep 3 at 16:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .