4

We had a small widget that allowed customers to share records that were set to a private sharing model in our community. Everything was rather simple and it would simply allow them to select users that were visible via Sharing Sets and create an __Share record in APEX.

I've been reported recently that an error is thrown but only on the community side of things. Nothing seems to be working where it was working. We are using Customer Community Plus licenses.

The error being thrown is : System.TypeException: DML operation INSERT not allowed on <Object>__Share which seemed to indicate access not available on the object. That seems odd because they are able to interact with the object just fine in order to create/edit/delete them.

I looked up the Sharing Model (its private both internally and externally), I looked at the profile and their access and the sharing sets in the community. Like I said, they seem to interact fine with the objects when it comes to seeing the records and their right.

Additionally, standard license users can use the component fine and also share with community users without a problem. They also see the records as expected.

Am I missing an update or something that seem to make it so this doesn't work anymore? Anyone having trouble with this or encountered the same problem?

Improve this question
7
  • Which Object are you trying to share from Community?
    – Jayant Das
    Feb 15, 2019 at 21:38
  • Have you accidentally clicked on Disable External Organization SHaring? developer.salesforce.com/docs/…
    – Pranay Jaiswal
    Feb 15, 2019 at 21:40
  • 1
    @PranayJaiswal if external owd is disabled, it inherits from internal. And in this case OP mentions both are private, so even if external is disabled, it won't have any impact.
    – Jayant Das
    Feb 15, 2019 at 21:44
  • @JayantDas Correct. Its enabled and both are private. Also, I am using this on Custom Objects and used a generic name because there are more than one.
    – P. Lapointe
    Feb 15, 2019 at 21:46
  • @P.Lapointe Are you sure this worked before? And if yes, how was it implemented?
    – Jayant Das
    Feb 15, 2019 at 21:50

1 Answer 1

Reset to default
5

If you refer to Sharing a Record Using Apex documentation, and within that refer to the section (all the way at the bottom of the page) Creating Apex Managed Sharing for Customer Community Plus users, you will find that Share objects are not available for Customer Community Plus Licenses. The complete text from the documentation is as below (emphasis mine).

You will need to address this situation by taking the approach as mentioned in the documentation (by using without sharing).

Creating Apex Managed Sharing for Customer Community Plus users

Customer Community Plus users are previously known as Customer Portal users. Share objects, such as AccountShare and ContactShare, aren’t available to these users. If you must use share objects as a Customer Community Plus user, consider using a trigger, which operates with the without sharing keyword by default. Otherwise, use an inner class with the same keyword to enable the DML operation to run successfully. A separate utility class can also be used to enable this access.

Granting visibility via manual/apex shares written to the share objects is supported but the objects themselves aren't available to Customer Community Plus users. However, other users can add shares that grant access to Customer Community Plus users.

Improve this answer
3
  • It seems the without sharing keyword was removed recently as part of a security check. This wasn't caught anywhere and it only resurfaced now. Putting it works fine. Will investigate to find an appropriate way to handle this since Lightning sharing is not a thing yet.
    – P. Lapointe
    Feb 15, 2019 at 22:02
  • 1
    That's your culprit! Glad you were able to find it real quick.
    – Jayant Das
    Feb 15, 2019 at 22:02
  • What you could do is have a utility (sub)class that is explicitly "without sharing" but only performs specific functions. Make sure to comment/document WHY you are legitimately executing this piece without sharing. The main component controller should always be "with sharing" but it can call the utility to do the DML with elevated privileges. Ideally the "without sharing" utility should also do some checks as to whether it is a legit use case.
    – Charles T
    Feb 16, 2019 at 17:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .