3

I'm trying to use Permission Set to grant some users the ability to edit an object, with the caveat that there's 1 field that is not editable to them. I've tried setting the Object Level Security for that Permission to include Edit, and for the Field Level Security I uncheck Edit for that particular field. However, when I log in as a user with that Permission Set I can still edit the field without any errors. I also tried to exclude Edit in the Object Level Security and manually check Edit for all other fields in Field Level Security, but it ends up not showing the Edit button at all; so now I'm stumped...

I'd really appreciate any pointer from you guys, thanks in advance!

3
  • welcome to stackexchange ! Commented Sep 27, 2013 at 3:48
  • Does the user's profile have edit permission on that field?
    – Sam
    Commented Sep 27, 2013 at 4:40
  • @theGreatDanton You're very correct, it turns out that the user profile does have edit permission on that field. When I turn it off everything works correctly! Thanks a lot.
    – dangmai
    Commented Sep 27, 2013 at 13:55

2 Answers 2

5

https://success.salesforce.com/answers?id=90630000000gkeYAAQ

I recommend reading the above answers as the discussion clarifies what wins the race .Permission sets are meant for extending the accessibility not restricting the accessibility.

In your case you are expecting restriction through the permission sets by not checking edit for the particular field ,which is not possible through permission set if the profile already has the access to the edit the fields .

Rule of Thumb

"Among Profile & Permission sets whichever provides greater visibility wins the race." Permission sets extend users' functional access and not meant for restriction

1
  • Thanks a lot! I actually did read that thread but couldn't manage to get it to work yesterday. Today I looked at the profile again and figured it out: even though I turned off all CRUD access to that object for that profile, the Edit checkbox next to that field in the Profile is still checked; when I turned it off everything works correctly. Note to self: Profile FLS overrides OLS settings!
    – dangmai
    Commented Sep 27, 2013 at 13:54
0

You can always run SOQL against object and field permissions to determine what a user's effective access is across their profile and all permission sets:

SELECT Id, SObjectType, PermissionsRead, Parent.label, Parent.IsOwnedByProfile
FROM ObjectPermissions
WHERE (ParentId
IN (SELECT PermissionSetId
    FROM PermissionSetAssignment
    WHERE Assignee.Name = 'John Doe'))
    AND
   (PermissionsRead = true)
    AND
   (SobjectType = 'Account')

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .