Deploying a permission set using a change set that only references managed objects

Question

I'm attempting to deploy a permission set from sandbox to production. The permission set only references managed objects and when I "View/Add Dependencies" it includes references 1,162. 2 of those are custom fields created by me and are included in the change set. 1,160 of them are managed (apex classes, VF pages, custom objects, custom fields, and tabs) and I can't include them in the change set.

When I upload the change set it shows up blank...because the elements themselves aren't included in the change set.

Is there a way to make this work? A hack even?

Answer 1

really interesting use case. I've been out of permission sets for a while so I'm not sure I have a fantastic answer for 'why' this is occurring beyond the fact that managed components have a complex ownership and containment model (e.g. do you own it as a subscriber or does the publisher own rights to mutate?).

The ISV force guide provides some guidance around this - which recommends creating cloned permission sets with the managed permissions. Check out https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/packaging_perm_sets_profile_setttings.htm for more information.

The typical workaround I usually recommend when all else fails is to manage permission via the API directly post change set deployment.

It's relatively easy to run SOQL on your sandbox permission sets and then upsert those permissions via the API pointing to your product instance post deployment.

Some good posts I wrote up previously include:

http://www.salesforcehacker.com/2013/02/soql-pinball-wizard-cleans-up.html

and

http://www.salesforcehacker.com/2013/01/using-soql-to-determine-your-forcecom.html

Good luck!! Let me know how it goes!!