1

I have a profile named 'Profile A' and a custom object named 'CA__c'. Then Profile A setting has Read, View All object permission. Basically, users with Profile A shouldn't be able to edit CA__c, but I need to give them edit access to only one field(checkbox). In the Profile setting I added the Edit access to the object permission and set all field permissions to Read Access(read-only) except for the checkbox which they should be able to edit. However, I get an error message whenever I log in as user with Profile A and edit the checkbox.

Error: You do not have the level of access necessary to perform the operation you requested. Please contact the owner of the record or your administrator if access is necessary.

P.S. The org wide default of the custom obj is set to Private.

Any thoughts on how will I be able to give edit access to just one field on that object?

Improve this question

3 Answers 3

Reset to default
3

The org wide default of the custom obj is set to Private, only record owner and people who are above in the Role hierarchy can have full access this record. If owner/users above role hierarchy has edit access to the object in the profile level then those people can edit the record.

If the record is shared to user with Read/Write permission then only those users can edit the record.

If record owner is different, then other users can view the record, even though they could have edit permission at profile level, they won't able to edit other user's (owner's) record.

Secondly, to give a edit permission to a particular field, the object should have Edit permission at Object Level, which you have already given.

Here record level access comes into play rather than profile/permission set level access.

Refer the following diagram to open up the access

Sharing architecture

Improve this answer
1
  • Thanks Santanu for explaning it vividly! Now, I've created a criteria based Sharing Rule on my custom object, so if this criteria is then true, the users in Profile A with Role A will then have edit access to the object but only to that specific field since other fields are in read-only.
    – Loren
    Aug 13, 2017 at 18:41
1

From what you describe, your setup seems fine. Only thing that might be causing the issue is record access. Just because user has field access on an object, not necessary that they can edit all records.

Check if that user has edit access on that record that they are trying to edit (since it is org private, either that user needs to be owner or record is shared with that user).

Improve this answer
0
1

To edit records of the CA__c type, the user needs to have "Edit CA__c" on their profile, as well as record-level access to edit the record (either by sharing rule, or org-wide defaults set to Public Read/Write, or by hierarchy, or by ownership, or by Modify All Data). You can think of the security checks like this:

  • Can the user edit "CA__c" records (Profile permissions)?
  • Can the user edit a specific CA__c record (Record Sharing)?
  • Can the user edit a specific field on a CA__c record (Field Level Access)?

The user needs to satisfy all three conditions in order to update a single record.

So, add the Edit CA__c object permission, set up Sharing Rules, and then configure the Field Level Access, as appropriate. If you don't want them to be able to edit other fields, you can remove the Edit permission for most fields (except for globally required fields).

Improve this answer
1
  • Thanks for that sfdcfox! Now I have a clearer view of Salesforce's sharing settings. The stackexchange community has been so helpful :)
    – Loren
    Aug 13, 2017 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.