I am running a trigger whenever a contact is edited. In trigger I am querying user

[Select id from user]

I am getting all the users when trigger in run in any internal user context. But when same trigger is run in community user context I am getting only community member. Is this known behaviour or I am doing something wrong. Is there any Knowledge article for this?

I have found a similar question here :- Can community users reference internal users in Chatter?

up vote 4 down vote accepted

You can refer Determine User Visibility in Your Community

User sharing lets you decide whether all users in a community are visible to each other.

User sharing for external users is turned on by default when you enable Communities. This setting applies to all communities in your organization.

The default setting allows an external user to see other external users under the same account and users in common communities. You can change the organization-wide default for Users to make your communities more restrictive or open, depending on your use case.

If the you deselect Community User Visibility, external users can’t see each other. For example, John and Sally are external users. John can’t:

  • Search for Sally
  • Find Sally in the community People tab, even if Sally is a member of the community
  • Add Sally to a group
  • Share a file or record with Sally

If John and Sally are members of the same group or share the same record, then they can see each other’s conversations and updates within the group or on the record, but nowhere else.

If Sally belongs to the same account as John, and John has delegated external user administration privileges, then John can see Sally. Delegated External User Administration takes priority over user sharing.

So, your SOQL query returns the list of users based on above mentioned settings.

Check the OWD for user object in sharing setting. It will be public read/only for Internal and private for external.

That means, Internal users can querry all users whereas community user can only access user which are shared to them via sharing rule or manual sharing.

enter image description here

I am against providing read access of any Internal user to external user as I have seen they will be able to mention any internal users on chatter. Which can be bit spammy most of the times.

The best solution is to use without sharing keyword so that they can only access Internal user in code and thus minimizing the privacy of internal users in chatter.

  • Thanks Pranay for your help – Manjot Singh Nov 9 at 12:26
  • 1
    Be VERY CAREFUL using without sharing on Communities code as you don't want to expose a data leak (I have seen this happen in production solutions). The correct approach is to make your Apex controllers (of both Lightning and Visualforce) with sharing. If it needs to make decisions based on data unavailable to the user, it can call a without sharing helper class that accesses the privileged data, executes the business logic required from it, and returns the outcome of that logic to the controller. – Charles T Nov 9 at 13:16
  • Yes I am not using Without sharing keyword I am just going to add some users in community for now. @CharlesT – Manjot Singh Nov 9 at 14:01

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.