0

Does anyone know how I can restrict users from exporting/deleting data using data loader?

Thanks in advance

2 Answers 2

1

You can restrict the user by disabling "Api Enabled" permission. But this is not a vaible solution as it disables all other api interactions with salesforce.

Please vote for this idea. https://success.salesforce.com/ideaView?id=08730000000DitKAAS

1
  • The problem is how would Salesforce know that a particular SOAP API call is coming from Data Loader versus another software tool that uses the API? Do you want an "I am dataloader" string and rely on the client software correctly identifying itself? Commented Oct 10, 2016 at 5:54
1

The Force.com platform enforces permissions to data at the object access layer, so if the user has permission to view an object and if the user has API access rights, then they can access that object via a tool that uses the API such as workbench or dataloader, or a tool they wrote themselves.

This is the correct design. It's not realistic for Salesforce or any webservice to control access mechanisms -- for example, users could write their own bots to screen scrape data from the site. As Salesforce is a webservice, it can't control the software on user's machines that initiates the HTTP requests to retrieve data -- access control enforcement by Salesforce can only apply at the data layer.

If you want to exert further control over your users to specify how they access Salesforce (or any other webservice), you need to install endpoint security solutions to prevent use of unauthorized client software running on your users' computers, as well as other mechanisms to prevent users from bringing their own devices to your network which do not have the security software installed, and of course limiting access to your org only from your controlled intranet.

It is a good practice to use endpoint security mechanisms, since these are the linchpin of securing your org. Network access mechanisms don't have enough information to solve this problem on their own -- they need to be combined with endpoint control software.

If you don't care about things like bots and only want to put some obstacles in the way of using tools like data loader, then you have some choices:

  • remove API access rights from the user, to force them to use the UI to access objects. This assumes they wont use screen scraping software.

  • If the data you are trying to protect is limited in nature and you want to prevent API access to some objects only while maintaining access to other objects, you can try to remove all object access rights for the objects you are trying to protect (e.g. remove access from the profile) and then create custom visualforce pages (or lightning components) to expose the data. These would have apex classes that ignore the profile level perms. However you still have the screen scraping problem and this is a brittle, high touch solution that would prevent use of standard mechanisms for access control -- you are implementing your own access control layer as a replacement for Salesforce's standard mechanisms and so would need to implement your own security management code, define your own custom access control lists, etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .