I have a custom object called 'Advisor' and for every single record, I would like to allow authentication access for that one Advisor to log in and view their record and make changes.

For example, there is an Advisor_1 record in Advisor, and I would like to allow Advisor_1 to log in and view their own record (but not any other advisor's record). An Advisor is assigned Tickets (another custom object) and when an Advisor logs in to sales force they should be able to mark a Ticket as completed.

Is this possible to make a custom object "Authenticatable"? Or can you create a normal salesforce account, but only allow access to certain records within certain objects? I know you can allow access to only certain Objects, but can these permissions extend to records of Objects as well?

  • Have you looked at Record-Level Security? I think the "authentication" language may be a misnomer here. – David Reed Jan 17 at 20:17
  • This would be a great starting point, trailhead.salesforce.com/en/content/learn/modules/data_security/… – Pranay Jaiswal Jan 17 at 20:19
  • @DavidReed so I was able to use that to restrict access, however, I believe the Org-wide sharing setting I need to use on Advisor is Controlled By Parent and then add a User field of type Master-Detail Lookup to the Advisor object. The reason you need Master-Detail Lookup relationship is because that is the only way to get a Controlled By Parent option when selecting sharing settings. However, when I go to add that type of relationship to Advisor, User is not an option.... Is there a possible way around this? – BlondeSwan Jan 18 at 0:11
  • @BlondeSwan User cannot be the parent of a master-detail relationship, but that doesn't matter because it isn't what you need. You need an Org-Wide Default of Private, and the User that your Advisor uses to log in (perhaps some type of community license?) needs to own its corresponding Advisor record. – David Reed Jan 18 at 0:19
  • @BlondeSwan But all of that is dependent upon, as Adrian explained below, creating actual Users, and setting up a Community to support this objective is way beyond the scope of a comment. – David Reed Jan 18 at 0:20

The only way to authenticate is as a User. If you want a custom Advisor__c object which can log in, create a lookup from this object to User to indicate who this person can log in as. You can add a Process Builder flow to set the OwnerId on each Ticket__c record to Advisor__r.User__c, and it is certainly possible to set up a permission model where these users can only see records they own.

If you want someone to log in to your system, you have to create a User record and consume a license. Full stop.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.