I'm trying to query the OWD/Sharing rules for Account/Opportunity objects using SOQL to get data into a Visualforce Page.

Already took a look into the AccountSharing object, but it returns empty despite that under the Setup -> Security Controls -> Sharing Settings -> Accounts there are some Account Sharing Rules created.

I need to get it for an already calculated set of Users/profiles/Roles.

  • @AdrianLarson, is not about config by point and click, is to query the data using SOQL, something like SELECT If FROM ObjectSharingRule WHERE Role/User = 'Role/UserRecordId' and work with that dataset in APEX code. – joralbert Jan 6 '17 at 15:52
  • That's not at all what I'm asking. I want to know why you want the OWD setting (which is not specific to any User/Profile/Role). – Adrian Larson Jan 6 '17 at 15:54
  • Thank you for your help. The reason is business is asking for a query, to identify/filter users and get what/where they have access based on profile/Roles/permission Sets/Sharing rules. I have now the Permission Sets, but cannot find anything about Sharing/OWD from SOQL p.o.v. – joralbert Jan 6 '17 at 15:58
  • Okay, Role has basically nothing to do with that (it can control record level access but not object level). Are you just trying to look at Account? – Adrian Larson Jan 6 '17 at 15:58
  • Account and Opportunity. – joralbert Jan 6 '17 at 16:03

You need to look at the ObjectPermissions object. It's a bit convoluted, so it ends up significantly easier to ask "Which Users/Profiles have Read permission?" than it is to ask "What are all the permissions each User/Profile has?" It will increase your governor consumption, but keep the complexity of your code from growing too crazy. I'm not sure if you even care about any permissions besides Read, so I will just address that permission here.

I answered some very similar questions that provide building blocks here, so I will reference them below.

First take a look at Query Which Profiles Have Read Access To Specific Object? which can give you the Profile level view:

SELECT Profile.Name FROM PermissionSet
WHERE IsOwnedByProfile = true AND Id IN (
    SELECT ParentId FROM ObjectPermissions
    WHERE PermissionsRead = true
    AND SObjectType = 'Account'

You can iterate that List<PermissionSet> to get just the names if that meets your needs, or you can change Profile.Name to ProfileId and collect those Ids to query a List<Profile> if you need more data.

Next, take a look at How can we get the list of user those who have the read permission on the case sObject? which is subtly different but shows you how to get User level access:

Set<Id> userIdsWithAccess = new Map<Set<Id>();
for (PermisionSetAssignment assignment : [
    SELECT AssigneeId FROM PermissionSetAssignment
    WHERE PermissionSetId IN (
        SELECT ParentId FROM ObjectPermissions
        WHERE PermissionsRead = true
        AND SObjectType = 'Account'
]) userIdsWithAccess.add(assignment.AssigneeId);

List<User> usersWithCaseAccess = [
    SELECT Username FROM User
    WHERE Id IN :userIdsWithAccess

That should get you started. If you want to add in Edit permission, you'll follow a similar pattern. Same deal with Opportunity.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.