14

We are having some difficulty with permissions. Our admin has also posted on the success board. https://success.salesforce.com/answers?id=9063A000000eB7V, she also found this same posting: https://success.salesforce.com/answers?id=9063A000000l9eC I am posting here to see if there are any devs/admins on here that have run into this issue as well.

We have a process that is called from a platform event, which sends a visualforce email template in an email alert. It seems like the Automated Process user, which is the user that triggers the Platform Event, does not have access to the email template's visualforce controller. Is there any way to give access to the controller to that user?

5
  • Are there any profiles which do not have access to that page? Have you tried just giving access to all profiles as a shotgun approach?
    – Adrian Larson
    Mar 7, 2018 at 21:32
  • I've had a similar issue, here: salesforce.stackexchange.com/questions/202709/… There's no mention of such limits on the docs. Mar 7, 2018 at 21:36
  • @AdrianLarson yea, we gave all available profiles access
    – Olivia
    Mar 7, 2018 at 21:36
  • 1
    technically, AutomatedProcess is the running user that handles the subscription to the ProcessEvent (i.e. the Process Builder or trigger's running user) but not having access to a VF email template's controller would be a bug and should be reported to support.
    – cropredy
    Mar 7, 2018 at 23:17
  • There appears to be a knowledge article 000270230 that address this ? - help.salesforce.com/articleView?id=000270230&type=1
    – addy
    Jun 6, 2018 at 18:21

2 Answers 2

25

I've found Matt's answer on the IdeaExchange

You can follow the recommendation from Roy Lloyd and create a Permission Set and assign the autoproc User in Exec-Anonymous:

insert new PermissionSetAssignment(
    AssigneeId = [SELECT Id FROM User WHERE alias = 'autoproc'].Id,
    PermissionSetId = '<your Permission Set Id here>'
);

You should then be able to manage the Permission Set to add any new permissions you need.


Alternatively, use URL hacking:

Using the Developer Console to query for the autoproc Profile ID:

SELECT ProfileId FROM User WHERE Alias = 'autoproc'

Then use a URL hack to access the setup page and enable the relevant Apex Classes:

/_ui/system/user/ProfileApexClassPermissionEdit/e?profile_id={autoproc_profile_id}

Or to Apex Pages

/_ui/system/user/ProfileApexPagePermissionEdit/e?profile_id={autoproc_profile_id}

Or to Field Level Permissions:

/setup/layout/flsedit.jsp?id={autoproc_profile_id}&type={sObjectName}

Enable Apex Class Access

This resolved the error 'You do not have sufficient privileges to access the controller'.

1
  • 3
    For anyone else trying to work with custom Objects I had to access it via: /setup/layout/flsdetail.jsp?id={autoproc_profile_id}&type={sObjectId} Not the name. Sadly this didn't resolve my issue with merge fields in an email alert triggered by a scheduled flow salesforce.stackexchange.com/questions/323774/…
    – Gabriel M
    Oct 18, 2020 at 20:32
1

If you use an Apex trigger instead of Process as a subscriber, it is possible to specify the running user. This means you no longer have to change the Automated Process User, but can define and use your own user including permissions.

https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/platform_events_trigger_config.htm

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .