Migration of Standard Object Permissions using meta data deploy

Question

I am trying to migrate object permissions using metadata deploy in workbench.I am facing an issue - although I have explicitly stated the standard object in package.xml, the object permissions are not present in zip file that gets downloaded in retrieve(All the object level permissions are set to false in source org for that object). Here is my package.xml(I have included only contract):

<?xml version="1.0" encoding="UTF-8"?> <Package xmlns="http://soap.sforce.com/2006/04/metadata"> <types> <members>Contract</members> <name>CustomObject</name> </types> <types> <members>*</members> <name>Profile</name> </types> <version>36.0</version> </Package>

And here is the profile xml that gets downloaded:

<?xml version="1.0" encoding="UTF-8"?> <Profile xmlns="http://soap.sforce.com/2006/04/metadata"> <custom>true</custom> <fieldPermissions> <editable>false</editable> <field>Contract.ActivatedById</field> <readable>true</readable> </fieldPermissions> <fieldPermissions> <editable>false</editable> <field>Contract.ActivatedDate</field> <readable>true</readable> </fieldPermissions> <fieldPermissions> <editable>true</editable> <field>Contract.BillingAddress</field> <readable>true</readable> </fieldPermissions> <fieldPermissions> <editable>true</editable> <field>Contract.CompanySignedDate</field> <readable>true</readable> </fieldPermissions> <fieldPermissions> <editable>true</editable> <field>Contract.CompanySignedId</field> <readable>true</readable> </fieldPermissions> <fieldPermissions> <editable>true</editable> <field>Contract.ContractTerm</field> <readable>true</readable> </fieldPermissions> <fieldPermissions> <editable>true</editable> <field>Contract.CustomerSignedDate</field> <readable>true</readable> </fieldPermissions> <fieldPermissions> <editable>true</editable> <field>Contract.CustomerSignedId</field> <readable>true</readable> </fieldPermissions> <fieldPermissions> <editable>true</editable> <field>Contract.CustomerSignedTitle</field> <readable>true</readable> </fieldPermissions> <fieldPermissions> <editable>true</editable> <field>Contract.Description</field> <readable>true</readable> </fieldPermissions> <fieldPermissions> <editable>false</editable> <field>Contract.EndDate</field> <readable>true</readable> </fieldPermissions> <fieldPermissions> <editable>false</editable> <field>Contract.Name</field> <readable>false</readable> </fieldPermissions> <fieldPermissions> <editable>true</editable> <field>Contract.OwnerExpirationNotice</field> <readable>true</readable> </fieldPermissions> <fieldPermissions> <editable>false</editable> <field>Contract.Pricebook2Id</field> <readable>false</readable> </fieldPermissions> <fieldPermissions> <editable>true</editable> <field>Contract.ShippingAddress</field> <readable>true</readable> </fieldPermissions> <fieldPermissions> <editable>true</editable> <field>Contract.SpecialTerms</field> <readable>true</readable> </fieldPermissions> <fieldPermissions> <editable>true</editable> <field>Contract.StartDate</field> <readable>true</readable> </fieldPermissions> <loginIpRanges> <endAddress>255.255.255.255</endAddress> <startAddress>0.0.0.0</startAddress> </loginIpRanges> <userLicense>Salesforce</userLicense> <userPermissions> <enabled>true</enabled> <name>ApiEnabled</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>AssignTopics</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>ChatterEditOwnPost</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>ChatterFileLink</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>ChatterInternalUser</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>ChatterInviteExternalUsers</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>ChatterOwnGroups</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>ConvertLeads</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>CreateCustomizeReports</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>CreateTopics</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>DistributeFromPersWksp</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>EditOppLineItemUnitPrice</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>EditTask</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>EditTopics</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>EmailMass</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>EmailSingle</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>EnableNotifications</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>LightningExperienceUser</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>RunReports</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>SelectFilesFromSalesforce</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>SendSitRequests</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>ShowCompanyNameAsUserBadge</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>SubmitMacrosAllowed</name> </userPermissions> <userPermissions> <enabled>true</enabled> <name>ViewHelpLink</name> </userPermissions> </Profile>

So I have two questions: 1. Why are permissions are view setup and configuration not present in downloaded metadata from source? 2. Why are the object persmissions not downloaded for contract?

Both of the permission mentioned in the above two question are false in source org.

Thanks.

Answer 1

A bunch of metadata in Profiles are designed as a sparse matrix. In other words, if the security is set to false, it will not be present in the XML returned to you. This makes sense from salesforce perspective as they treat absence as a negative value. However, if you need to make changes to the XML after getting it from salesforce, this becomes a problem. Or worse, if you are trying to "turn off" permissions at the destination.

No way around this at the moment. You have to do this manually at the destination. Or edit the XML manually and then migrate.

Shameless plug: I deal with this on an everyday basis when supporting my product, SnapShot for change and release management. I can demo how we are helping you solve the problem in our product, if you are interested. It is a paid product.

Good luck!

Sridhar

Answer 2

Are your orgs on different versions? I am facing a similar issue and it's due to my sandbox org being winter 17 and my production instance on Summer 16. I receive an error regarding the ShowCompanyNameAsUserBadge permission, as it doesn't seem to be included in the summer 16 metadata.

Answer 3

I'm dealing with this error when moving lot of metadata from a Pre-release Winter'16 Org to a Summer'16 Org using the Force Migration Tool.

After a few errors like that, I think I do not need the <userPermissions> section on my profiles XML files, so after the last deployment y remove the entire <userPermissions> block from my XML files before deploy the package, using this regular expression for replacement

<userPermissions>([.\s\S]*)</userPermissions>

So I recommend to remove the entire <userPermissions> block from the XML profiles files if you are not updating user permisssions, anyway if you want to migrate user permissions you can do with an "only profiles" package, I mean...

Use this package.xml for retrieve profiles from source org, it will retrieve only Org related permissions, won't include any object, field, class or page permissions, then deploy the retrieved files, maybe you get some errors because Org incompatible permissions, you must remove those permissions from the files.

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>*</members>
        <name>Profile</name>
    </types>
    <version>34.0</version>
</Package>