Update FLS for multiple fields across profiles using eclispse

Question

we are in the process of merging two orgs and ran into a situation where we need to migrate few custom objects from org A to org B. The problem is, we are going to continue with the sharing model that Org B has. Now, I am wondering, if we deploy the objects using eclipse, will we be able to update FLS for the profiles in org B using eclipse or any other tools ?

Answer 1

Yes, you can migrate FLS using the Eclipse IDE or Metadata API. Basically, create a "package.xml" that contains both the objects to migrate permissions for and the profiles to export in a single file, then perform the retrieve call. The profiles directory will include one XML file per exported profile that will include both the object and field level security permissions for that profile. Here's an example:

Source

package.xml

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>Session__c.Product__c</members>
        <name>CustomField</name>
    </types>
    <types>
        <members>Admin</members>
        <name>Profile</name>
    </types>
    <version>32.0</version>
</Package>

Results

objects/Session__c.object (Truncated for brevity)

<?xml version="1.0" encoding="UTF-8"?>
<CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
    <fields>
        <fullName>Product__c</fullName>
        <externalId>false</externalId>
        <label>Product</label>
        <picklist>
            <picklistValues>
                <fullName>Analytics Cloud</fullName>
                <default>false</default>
            </picklistValues>
            <picklistValues>
                <fullName>AppExchange</fullName>
                <default>false</default>
            </picklistValues>
            <picklistValues>
                <fullName>Chatter</fullName>
                <default>false</default>
            </picklistValues>
            <!-- more values were here -->
            <sorted>true</sorted>
        </picklist>
        <trackHistory>false</trackHistory>
        <trackTrending>false</trackTrending>
        <type>MultiselectPicklist</type>
        <visibleLines>5</visibleLines>
    </fields>
</CustomObject>

profiles/Admin.profile (Truncated for brevity)

<?xml version="1.0" encoding="UTF-8"?>
<Profile xmlns="http://soap.sforce.com/2006/04/metadata">
    <custom>false</custom>
    <fieldPermissions>
        <editable>true</editable>
        <field>Session__c.Product__c</field>
        <readable>true</readable>
    </fieldPermissions>
    <userLicense>Salesforce</userLicense>
    <!-- many userPermissions omitted here for brevity -->
    <userPermissions>
        <enabled>true</enabled>
        <name>ViewSetup</name>
    </userPermissions>
</Profile>

As you can see, just the field permissions were exported for the specified fields. You can also specify objects, which will return all fields that can have their security customized and the object's permissions (create, read, edit, update, view all, modify all).

The trick is merging together all of the other standard permissions, which are always exported. Once you're sure the core permissions (e.g. View Setup) are all in sync, you can freely export and import permissions with various fields and objects at will. You don't need to deploy the objects/ directory when deploying new permissions; simply deploying the profiles/ directory is sufficient for updating permissions. Your package.xml for deployment can look like this:

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>*</members>
        <name>Profile</name>
    </types>
    <version>32.0</version>
</Package>

Please note that not all fields will necessarily appear in the export, so you will still need to manually review the field security later, but this can save you hours of time simply by being able to deploy most settings correctly.