Grant access to records realted to the parent account on partner communities

Question

I'm trying to figure out what is the best way to manage the permissions for your partner communities users in the scenario

We have an account with contacts related that represent our partners and their workers and related to that account we have a custom object through a lookup field that represent the projects that this partner is managing for us,

the requirement is that all the workers of a partner be able to see all the records related with his parent account.

I know that there is an option using triggers and apex to insert in the sharing object but in this object we will have thousands of records and the trigger that will share all the records of this object to a new partner user in the future could hit the limits so...Some one knows any work around?

Is strange but it could be solved with sharing sets but they aren't available to partner users. Thanks!

Answer 1

On thing that I've done in the past is to use a trigger to make the owner of each record that you want visible a special user. This user is a Standard Community User. Then, everyone else needs to have a role that is higher than this in the Role Hierarchy. You will need 2 roles in this instance.

Note, if you have already created users for the Community, you will need to delete them and recreate them for them to work with your roles.

The OTHER options is to make everyone a Super-User -which will give them access to all the data of users for the same account. As long as everyone is attached to the same account, they'll be able to see everything.

From Salesforce:

Super users have access to data owned by other partner users belonging to the same account who 41 Set Up Your First Community Delegate External User Administration have the same role or a role below them in the role hierarchy

Source is here

Hope this helps.

Answer 2

@vanch, I assume the custom object is inheriting access from the parent account - or if it's a lookup, may be not. If it is the former, a simple account sharing rule would grant appropriate access to the portal role/subordinates which should cover all workers for that account. The number of sharing rule records would be the same as the number of accounts rather than the number of workers.