5

Why does Professional Edition allow viewing Managed Package Permission Sets & assigning them to Users?

Are there any Permissions that can be set in a Permission Set that affect a User's Permissions in Professional Edition?

6

When we made the decision to allow permission sets in professional edition, it was to follow a similar model to profiles:

  1. you can assign them but you can't create or edit them without having customizable profiles enabled in your org
  2. ISVs (Independent Software Vendor) can provide access to their features by embedding permission sets in their package with more specific access than what we allow for profiles through the package installation wizard. This access can include access to their custom objects, fields, apex classes, or visualforce pages. However, it cannot include access to standard functionality like user permissions, standard objects, standard fields, IP ranges, etc...

To answer your original question, if you mean user permissions like Modify All Data, no, it's not possible to affect user permissions with permission sets. The reason for this is that user permissions are not supported with packaging - for instance, it's not possible for an ISV to assign Modify All Data in a permission set that they package with their other metadata and you install as a subscriber. It's also not possible for an ISV to add access to standard object or field permissions in a packaged permission set which could otherwise have an impact on user permissions.

However, if you mean a user's permissions like CRUD to a packaged object or field, then yes, by assigning that packaged permission set to a user in professional edition, that user will now have access to that ISV's field or object. Since this is limited to what an ISV can add - it should protect you from inadvertently affecting any user's access to non-package metadata.

To see an example of what is possible from what is not with regards to permission sets in professional edition, check out the following blog posting: http://www.salesforcehacker.com/2013/05/whered-that-field-go-installing.html.

Hope this helps...

|improve this answer|||||
  • Thanks @adam-torman between this answer, and especially your blog post that you linked to, I understand that what I was missing was how Permission Sets interact with Page Layouts in GE/PE, which is different than the interaction in EE/UE. – mjgallag Jul 9 '13 at 1:31
0

From the ISV Force Guide page titled Features Available in Group and Professional Editions, permission sets aren't available for use by managed packages in the Professional Edition. You'll note that custom profiles are also not available in that edition either.

|improve this answer|||||
  • Interestingly na1.salesforce.com/help/doc/en/perm_sets_overview.htm contradicts that in the Note section: "In Group and Professional Editions, permission sets may be included in installed packages, where they can be viewed and assigned to users but not edited." I have confirmed that I can in fact do just that, so the Note is correct. What I can't seem to figure out is what the point is, given Professional Edition's security model. – mjgallag Jun 1 '13 at 0:55
  • That is interesting. I agree there doesn't seem to be any point to it considering the security model that exists in the Professional Edition. I strongly suspect it's been added to provide compatibility support for Managed Packages created for the other editions. That would simplify things for ISV's AND expand the number of Apps available to support Prof Edition users. – crmprogdev Jun 1 '13 at 3:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.