Permissionset issue in Apex

Question

When I try to look for a permission set associated with a particular user in a controller class, I am seeing a permissionset with name X00ed0000000TTlfAAG and ID 0PSd0000000XJ15 related to the user. (I searched for this permission set I am unable to find how this is related to the user).

I tried from DEV console and I get nothing back too:

Execute Anonymous: list users_info = [SELECT PermissionSet.id,AssigneeId FROM PermissionSetAssignment WHERE Id =:'0PSd0000000XJ15'];

11:20:49.019 (19656000)|SOQL_EXECUTE_BEGIN|[1]|Aggregations:0|select PermissionSet.id, AssigneeId from PermissionSetAssignment where Id = :tmpVar1
11:20:49.032 (32737000)|SOQL_EXECUTE_END|[1]|Rows:0

I am a sys admin in my org , When I try to copy paste this URL I get insufficient priviledges. I checked the Recyle bin too , nothing there to delete.

Is this a bug , the ID seems to be a valid permset ID.?

Answer 1

the PermissionSet IsOwnedByProfile as you can tell from the name (00e is the Profile keyprefix)

set permission set details here: http://www.salesforce.com/us/developer/docs/api/index_Left.htm#StartTopic=Content/sforce_api_objects_permissionset.htm

your query will never return a value because the PermissionSetAssignment record ids start with 0Pa

[SELECT PermissionSet.id,AssigneeId FROM PermissionSetAssignment WHERE PermissionSet.id =:'0PSd0000000XJ15'

UPDATE here's the query that solved the question

[select Id, Name[,......] from PermissionSet where Id IN (select Id from PermissionSetAssignment where AssigneeId =: USER_ID_PROVIDED_BY_THE_USER)]

Answer 2

There are two categories of PermissionSets that are stored in the PermissionSet object:

• standalone Permission Sets (have IsOwnedByProfile = false)
• Permission Sets owned by Profiles (have IsOwnedByProfile = true)

Standalone Permission Sets are the ones you are used to; they appear in the list of PermissionSets when you click on 'Permission Sets' from the Setup menu, and you can assign them to users using the PermissionSetAssignment object. You can Create, Edit, and Delete Standalone Permission Sets. They are NOT associated with any particular Profile.

Permission Sets owned by Profiles are the strange ones you are seeing above that start with X00. Under the hood, each Salesforce Profile record has an associated PermissionSet record, which links together all of the Object, Field, App, User, and Setup Entity Access permissions that define the Profile. These do NOT appear in the Setup menu's "Permission Sets" area, because they are represented by their corresponding Profiles. Moreover, they are NOT assigned to users, at least not directly --- the ProfileId field on the user record is the only link that connects you to the associated Profile's corresponding PermissionSet.

In your class above, you should filter out the PermissionSets owned by Profiles by adding IsOwnedByProfile = true to your SOQL WHERE clause:

List<PermissionSet> standalonePermSets = [
   select Id,Name from PermissionSet where IsOwnedByProfile = false
];