1

We need to check in our code whether a user has system admin privileges to provide access to a feature. So far, we had been checking that the user matched the profileid of a System admin by querying profile.name='System Administrator'. However, this wouldn't work if the system administrator profile has been cloned to another profile, lets say - 'System admin - 2'

How do I validate that these users are system admin as well?

3

You should be checking individual permissions, not the profile name. A user is a system administrator if they have Modify All Data and Customize Application. You may also want to consider permission sets. A user therefore is an administrator if they have these permissions from any assigned permission set. Try the following:

Boolean isUserAdmin = 0 < [
  SELECT  COUNT()
  FROM    PermissionSetAssignment
  WHERE   AssigneeId = :UserInfo.getUserId() AND
          PermissionSetId IN (
            SELECT  Id 
            FROM    PermissionSet 
            WHERE   PermissionsModifyAllData = TRUE AND
                    PermissionsCustomizeApplication = TRUE
            )];
  • Ah I see, was hoping that there was an API at UserInfo level to determine whether the user was an admin user. But this helps. Thanks! – Tan Jul 10 '17 at 20:47
  • @Tan Yeah, once cloned, there's no tie back to the original record. Furthermore, a cloned profile could later have the admin permissions revoked. It's much more reliable to check user permissions instead. – sfdcfox Jul 10 '17 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.