Deploying Profiles / Permission Sets that include object & field permissions for Managed Objects

Question

Anyone know if it's possible to deploy profiles/permission sets via Eclipse or an Unmanaged Package that contain object & field permissions for 3rd party managed objects?

I'm trying to deploy a profile from one org that contains object/field permissions for objects that are part of a managed package (not a package that I have access to, but that is from a 3rd party vendor).

The problem that I'm running into is that the profile/permission set XML files in eclipse don't even contain the object/field permissions for these managed objects, they only contain the object/field permissions for standard Salesforce objects & custom unmanaged objects.

I'm able to deploy the profiles/permissions sets to another org but only the premissions for standard & custom unmanaged objects get migrated... none of the permissions for the 3rd party managed objects move.

Answer 1

This is possible, provided your package.xml is configured correctly. From the directions at http://boards.developerforce.com/t5/AppExchange-Directory-Packaging/Reading-complete-profiles-using-the-Metadata-API-or-sf-retrieve/td-p/213903

Using Field Trip as an example, in my package.xml:

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>  
        <members>Field_Trip__Field_Analysis__c</members>
        <name>CustomObject</name>
    </types>
    <types>
        <members>*</members>
        <name>Profile</name>
    </types>
    <version>25.0</version>
</Package>

In the profile XML retrieved I see:

<fieldPermissions>
        <editable>true</editable>
        <field>Field_Trip__Field_Analysis__c.Field_Trip__Field_Created_Date__c</field>
        <readable>true</readable>
    </fieldPermissions>
    <fieldPermissions>
        <editable>true</editable>
        <field>Field_Trip__Field_Analysis__c.Field_Trip__Label__c</field>
        <readable>true</readable>
    </fieldPermissions>

Answer 2

This is absolutely possible. What is not possible is to retrieve or deploy managed components like a managed permission set. These components are considered protected and immutable.

However, by retrieving the managed CustomObject member metadata along with your own custom profile/permission set metadata, as in @Mike Chale's example, you will have access to set permissions on your custom profile/permission set metadata.

Just go into your .Profile settings file in eclipse and modify the permissions. There should be no reason why this isn't possible deploying by eclipse but if you want to test this, try it out deploying using the http://workbench.developerforce.com utility - just go to migration >> deploy to deploy your custom zip file.

One way to think of it is: managed components are owned by the ISV/package publisher, but since custom profiles and permission sets in your org are owned by you, you can always modify them (as long as you include the publisher namespace prefix in your deployment) including managed component permissions.