Can I retrieve a Profile's XML with Managed Package metadata?

Question

I am currently attempting to update a new profile's permissions to match that of another profile (different license types, so cloning isn't available).

My current best solution is to pull various metadata types through SFDX along with the old and new profiles, copy the xml from the old profile to the new, and redeploy.

Only problem is, when I retrieve CustomObject and CustomField metadata, it only includes unpackaged objects/fields. I have a large managed package with many objects and customized levels of CRUD permissions, and I'm looking to update CRUD and FLS for those packaged objects and fields.

Is there a way to get managed package objects/fields in the profile metadata as well?

Here is my current package.xml:

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>*</members>
        <name>CustomField</name>
    </types>
    <types>
        <members>*</members>
        <name>CustomObject</name>
    </types>
    <types>
        <members>Commercial Lending Manager</members>
        <members>Loan Closing</members>
        <name>Profile</name>
    </types>
    <version>41.0</version>
</Package>

Answer 1

Yes, you can

DISCLAIMER :I am the author of the below mentioned module.

I had the similar problem few weeks ago and am able to resolve it using below module.

Hope this answer finds you. In case you are still looking for it.There a CLI which has a capability to retrive full profile xml along with CRUD and FLS. Written as a node module.Here are steps.

NOTE: this is a wrapper module which internally uses sfdx cli.

1. Install Node.js

if you dont already have.

2. Type in node -v . to confirm you have it working .

3. Run npm install -g mydxcli

4. From Folder of your choice run the command.

mydxcli -u Myusername -getProfile "Profile1,Profile2" --getPermissionSet "PS1,PS2"

--username or -u : You org's username or alias name Required

--getProfile or -gP : Specify profile names you want to retrieve
optional : if value is not specified , it will fetch all profiles in org

--getPermissionSet or -gPs : Specify PermissionSet names you want to retrieve
optional : if value is not specified , it will fetch all PermissionSets in org

--directory -d : The Directory where you want to retrieve the files
if not specified default folder will be mydxcli

--help // Fetches available options

Module Link: mydxcli

What the Module does internally :

1. Gets the List of class,pages,custom objects using mdapi:listmetadata
2. Dynamically generates package.xml based on it.
3. performs mdapi:retrieve to specified folder and the profile now retrieved contains all desired values.

Answer 2

You can retrieve a Profile containing the SObject and VF Page access information for your managed components if you explicitly enumerate all of the managed components. This doc says it:

https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/manifest_samples.htm

When retrieving and deploying managed component permissions, specify the namespace followed by two underscores. Wildcards are not supported.

So in your package.xml, you'd need to enumerate fields using any of the available APIs (SOQL to get the list of VF pages from the ApexPages SObject .. or use Field Describe info from the REST API to get the list of SObjects in the org) and then add them so it looks like

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>Contact.MyPackage__FieldA__c</members>
        <members>Contact.MyPackage__FieldB__c</members>
        <name>CustomField</name>
    </types>
    <types>
        <members>MyPackage__MyObject__c</members>
        <name>CustomObject</name>
    </types>
    <types>
        <members>Commercial Lending Manager</members>
        <members>Loan Closing</members>
        <name>Profile</name>
    </types>
    <version>41.0</version>
</Package>