I have Org-Wide Defaults set to Private/Private with Grant Access Using Hierarchies unchecked on a custom object.

I have a sharing rule that says users may read the object if it is marked Active = True (boolean/checkbox).

For some reason my Portal users can see the inactive object even though none of the internal users can.

If I remove "read" on the object permissions (with the sharing rule in place) for the Portal user, they can't see the object at all.

Can anyone help me understand what I am missing?

  • Do you have role hierarchy in your system? – tugce Mar 13 '18 at 19:10

It's working as intended. Check the Profile section in setup so you can see the object permissions for your internal and portal users. Looks like you didn't give read access to your internal users.

Don't forget that seeing the fact that an object exists at all (object permission) is different than seeing records on that object (org-wide defaults, access, sharing rules, etc).

Edit: For limiting active/inactive record visibility, please specify if you're using Customer Community Plus or Customer Community or Partner Community users. "Portal" users technically don't exist in Salesforce anymore.

  • If I understanded question correctly Portal Users see all active and inactive records of the custom object while internal users see active records. OP wants portal users to see only active records. – tugce Mar 13 '18 at 18:57
  • @tugce That's not how I read it, as OP describes object permissions and seeing the object, as opposed to OWD and seeing the records. – DavidSchach Mar 13 '18 at 19:18
  • @tugce I agree with what OP wants users to see, but before that can be handled, basic security has to be sorted out. – DavidSchach Mar 13 '18 at 19:19
  • I think OP mixed up object/record words. "For some reason my Portal users can see the inactive object even though none of the internal users can." I think OP meant records not object. But you might be right, this is just how I understanded the question. :) – tugce Mar 13 '18 at 19:22
  • Thanks everyone who chimed in. It is due to Apex sharing, set up by an implementation team. – user3678313 Mar 14 '18 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.