4

First of all, please forgive my ignorance as I am new to Salesforce's Lightning app/component.

I just would like to ask, how do you restrict a lightning app based on profile or permission set? For example you have a Lightning app called "SalesForecaster.app" and you want it to be accessible only to users with "Account Executive" profile/permission set, where do you set that up?

Because right now, the app is accessible via [your_salesforce_instance]/c/SalesFocecaster.app by any user.

Heck it is even accessible via community like [community_domain].force.com/[community_site]/c/SalesFocecaster.app by community-license users.

Hope you can help me.

THANK YOU!!!

1

I fear this needs to be handled manually inside the Code .There are certain things which can ensure your sensitive data from SFDC is not accessible

1.Write your controller class using with sharing so that sharing applies .For CRUD and FLS ensure you do a check at back end .

Check samples on how to check FLS in apex code here

2.If you want to hide sections and show a error display use aura:if component at beginning to stop rendering of section.

And obviously if you create Lightning app and tabs don't expose that to profiles not needing it .This way for non technical persons ,I don't think it will be easy to hack the URL unless they come across this post .

Unfortunately at this stage I don't see any other way this is provided out of box.

  • additional apex, apex-driven security check = more complex, harder to maintain. we have community/portal where we plan to publish several links pointing to lightning apps (pages). employee and managers share the same portal. we have an evaluation app, that's intended only to managers. the link however is visible to both profiles. so if a non-manager logs in, and click on the evaluation link, he's getting to the app. – pnoytechie Jan 25 '16 at 3:22
  • That's what it is now for time being.. – Mohith Shrivastava Jan 25 '16 at 3:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.