1

I added some custom settings for my Lightning Component to put some security related fields like APIKey and Username to be used for the rest API. As these fields can be different for each organization I need each organization Admin fill those information and it is based on each organization not based on the users . I used custom setting as it is recommended on : https://trailhead.salesforce.com/modules/secure-secret-storage

Is it possible to have custom setting visible only for Admin and not for the rest of the users ?

  • 1
    You should use Field Level Security to ensure that only appropriate users can view/edit the fields, or a Custom Permission if that makes more sense. Custom Settings are not generally advisable for "security related" features. If you must put secrets in Custom Settings, make sure you encrypt them so they cannot be casually read. Also, in context of asking a question, we don't have enough information to give you the the most appropriate answer. Please edit your question and explain what you're trying to do. – sfdcfox Mar 20 '18 at 18:52
  • Thanks @sfdcfox , I updated my question , hope it makes sense – Somayeh Ghazvinian Mar 20 '18 at 19:14
2

You can't selectively hide a custom setting value from users. As such, you should use the advice given in Storing Sensitive Data:

Custom settings enable application developers to create custom sets of data, as well as create and associate custom data for an organization, profile, or specific user. However, setting the visibility of the Custom Setting Definition to “Protected” and including it in a managed package ensures that it’s only accessible programmatically via Apex code that exists within your package. This is useful for secrets that need to generated at install time or initialized by the admin user.

Unlike custom metadata types, custom settings can be updated at runtime in your Apex class, but cannot be updated via the Metadata Api.

Simply by marking your Custom Settings as Protected will prevent even Administrators from viewing or modifying the values directly in Setup. This way, you, the developer, control access to those settings by providing them with a Visualforce page or Lightning component that calls Apex Code in your package's namespace to configure the values. Your code, including classes and triggers, can access the data normally, but it will be protected from outside, including from all other installed managed packages and all users.

I strongly advise that you read the document linked above for additional information and precautions you should take.

  • Thanks @sfdcfox ,That's correct , If I make them Protected it will not be visible to any one , Then I need to create a VF page to let user to put the value there , then Is it possible to add permission to that page to be view-able only by Admin ? – Somayeh Ghazvinian Mar 20 '18 at 19:55
  • @SomayehGhazvinian Typically, the page's access would be configured by an administrator. Preferably, you should make it write-only. Administrators can set a value, but they can't read it back once set. This all but eliminates the possibility of leaks. If you wanted to make a check internally, you could also simply query the user's permissions and see if they have any permission where ModifyAllData is true. However, I usually prefer to let administrators define who can use something, so you might just want a Custom Permission in a Permission Set; admins can assign permissions as they like. – sfdcfox Mar 20 '18 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.