what is the best practice of packing your custom app with custom permission

Question

what is the best practice of packing your custom app with custom permission, so that an administrator who install the app doesn't have to do too much work on the security end and all user have access the App Directly

Answer 1

Ideally, you would just include permissions sets, and all would be well. But it depends on whether you are trying to include permissions for standard objects, or just custom objects, tabs etc. If you have a self contained app with no references to standard objects, a permission set SHOULD work. But if you have references to standard objects, be careful with permission sets - they have been known to cause internal server errors when installing a package. I would suggest adding some permission sets, and then creating a beta package to check a) the package installs b) the permission set is maintained in the target org (I have seen it where the permission set is there, but nothing is checked in the target org)

You can certainly include a Profile, but permission sets make more sense for most apps. If you can't include one, I would at least document what it should contains so an admin can build one in their org.

Answer 2

Its important you include a specific custom profiles and permission sets in your package if that's important .

When designing your app for AppExchange, create custom profiles for the various users of your app. Give each custom profile the appropriate level of access to your app, such as tab visibility or field-level security settings for approval fields on custom objects.

When you package an app, you can include your custom profiles. Profile settings are applied to existing profiles in the subscriber's organization on install or upgrade.

Only permissions related to new components created as part of the install or upgrade are applied. The security settings associated with standard objects and existing custom objects in an installer's organization are unaffected.

Alternatively, you can use permission sets to avoid overwriting permissions in subscriber profiles and to maintain control of permission settings through the upgrade process. Permission sets contain a subset of profile access settings, including object permissions, field permissions, Apex class access, and Visualforce page access. These are the same permissions that are available on profiles. You can add a permission set as a component in a package.