I am having trouble putting the different aspects of enforcing CRUD/FLS/Sharing Rules into perspective. Reading through the manuals and doing extensive tests on my own, I came to the following conclusions:

For sharing I deducted the following: with sharing enforces sharing rules. When a user owns a record or it is shared with the user, he has full access to the object, irrespective of CRUD / FLS settings. So if the user has no read access to the object but a record of this object is shared with him, he cannot access it in the regular Salesforce UI, but via Apex.

For CRUD/FLS I deducted the following: [sObjectInstance].getDescribe() in combination with .isAccessible() etc. allows to check for CRUD of a record, while analogously with [sObjectInstance].getDescribe().getMap() allows to check for FLS of a record. However, if the object is accessible in the users CRUD settings, the OWD are set to private and the record is shared with the user, but the record is not owned by him, I will receive the message that this record is not accessible to the user. In the regular Salesforce UI the user would be able to access the record.

Now, I can combine both functionalities to check CRUD/FLS/sharing to get a picture of whether a user has access to any record. However, with sharing already "filters out" records I have no access to.

My questions: If I want to have access to all records, but make my output based on whether the current user access (meaning he owns it/has sharing access and CRUD/FLS allow access as well), I have to do an SOQL-Query for the Sharing Relation and check for CRUD/FLS with [sObjectInstance].getDescribe() etc?

Are my assessments correct? Am I missing something?

Thank you so much

  • 1
    All of what you mentioned are metadata (object and fields) related. If you want to know access around a specific record or set of records read this: developer.salesforce.com/docs/atlas.en-us.api.meta/api/… – Eric Sep 25 '16 at 18:16
  • Oh wow, thanks, that helps me a lot! Is with sharing really metadata related? I understood it was also on a record level. Can you confirm I am right about my assessments of with sharing and the programmatic CRUD/FLS determination? – Fynh Sep 25 '16 at 18:21
  • Yea, with sharing is record level but as you said you have to attempt to query the records and know that u should get results but got 0. Kinda guessing at that point – Eric Sep 25 '16 at 18:43
  • Remember though that with sharing is only about queries and read access. It doesn't tell you whether or not a user has update/delete access! In that respect, with sharing can be misleading. – crmprogdev Sep 25 '16 at 21:03

With the help of Eric I am going to try to answer my question by myself:

CRUD and FLS is part of metadata, so information about (custom) objects in general. With the Schema Class one should determine CRUD/FLS of objects, not records. Although you can receive the DescribesObjectResult for a record and the results might differ whether you own a record or not, you should use the Schema Class only to describe objects, not records.

Coming to access to records records, one can filter out records the current user has no access to with the with sharing keyword for classes, however this only partially describes record access. with sharing does not describe CRUD/FLS permission, but merely states that a record is owned by or shared with the current user, but not even if the current user has read access.

So if you really want to find out on a record level which access (any) user has to a specific record, a SOQL Query to the table UserRecordAccess is required, further information can be obtained here.

If nobody objects or has further additions, I will mark this as the correct answer in a couple of days.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.