6

We are executing some asynchronous code that uses getContentAsPdf on a Visualforce page as the result of handling custom platform event and we get this error in the Apex Jobs listing:

First error: [UNKNOWN_EXCEPTION] You do not have sufficient privileges to access the controller: LetterController

The "Automated Process" user (and its profile) that the events are handled under is pre-defined and not editable. And profiles would normally enforce access on the Visualforce page not the Apex controller so this error is inconsistent with that.

This looks like the same problem as this unanswered question from 6 months ago Automated Process User Permissions. (And perhaps this is related too: Salesforce doesn't merge fields on email sent in platform event context.)

Another piece of code that uses Messaging.sendEmail fails silently i.e. the message is not sent but the isSuccess() method of the result is true.

We will create a case with Salesforce about these, but has anyone done so and got these accepted as a defects? Or found a way to avoid the problems?

(The problem we are trying to solve using Platform Events is Running a Batchable under a different User than the User that called Database.executeBatch.)

  • Is it a showstopper for you? I have an ugliest workaround of Using calling executeAnon with proper user sessionId from a future/queueable. – Pranay Jaiswal Sep 7 '18 at 16:42
  • 1
    @PranayJaiswal The problem we were trying to use Platform Events to solve is Running a Batchable under a different User than the User that called Database.executeBatch. If your workaround solves that then do post an answer here or on that question. – Keith C Sep 7 '18 at 17:27
  • I answered , But now I saw, my answer is exact replica of what sfdcfox has said. :/ – Pranay Jaiswal Sep 7 '18 at 17:46
  • @PranayJaiswal Thanks for helping. I'll post where we get to with our case. We have some other approaches, but they seem in danger of running over e.g. the flex queue limit. Frustrating. – Keith C Sep 7 '18 at 23:35
3

Salesforce support has confirmed that the "Automated Process" user's permissions are lacking key ones and that there is no way to add permissions. And that the ability to switch to a specific User to execute the Platform Event triggers has no planned release version.

So the bottom line is, don't assume that everything will work when you are handling a Platform Event: test early before you waste your time.

PS

See vernimi2's suggestion that adding a permission set may work.

  • 1
    I can confirm that one permission missing from Automated Process is creating sharing records. Or maybe it can't be the creator but OwnerId is not visible so moot point. – Todd Dec 18 '18 at 2:25
  • Anyone heard whether Salesforce will be fixing this or is it yet another case of "live with it"? – Phil W Feb 28 at 11:50
1

I created a named credential for one of our admin integration users and perform a callout to send emails when triggered by a Platform Event. Pain the ass, but it works.

  • Thanks Mike. Yeah it's a weird world when the solution is to make a HTTPS call to yourself... – Keith C Sep 16 '18 at 8:31
  • For our case, where the aim is just to kick-off a batchble that does all the work (and where often the batchable will already be running so no need to make the callout) this may be the best way to go, replacing the use of the Platform Event. – Keith C Sep 16 '18 at 9:17
1

What helped in our project regarding the class access, for example when process builder is calling InvocableMethod annotated apex method and requires access to the class, was to assign the Automated Process user a permission set. The permission set cannot be assigned in the permission set assignment page in Salesforce UI and the assignments are not visible there.

It is possible to assign it through anonymous apex though, please see the example code below:

PermissionSet permissionSet = [
    SELECT Id, Name
    FROM PermissionSet
    WHERE Name = 'Automated_Process'
];

User automatedUser = [
    SELECT Id, Name
    FROM User
    WHERE Name = 'Automated Process'
];

PermissionSetAssignment pemissionAssignment = new PermissionSetAssignment(
    PermissionSetId = permissionSet.Id, 
    AssigneeId = automatedUser.Id
);

insert pemissionAssignment;

The code above assumes that Automated_Process permission set exists in the org. This can be used also for any CI automation when creating a scratch org where the class access or some other permission is needed for the Automated Process user.

Hope this helps little bit and would be interesting to see if it might solve the VF email templates access permissions, please let me know if you have a chance to try it.

  • Interesting; not working in this area right now but will keep in mind. Thanks for posting. – Keith C Jul 29 at 9:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.