3

Our managed package has some custom permissions that help provide an elevated set of capabilities to some users.

We have recently run into an issue with some people seeing this error message:

"Read" permission to object "CustomPermission" is not allowed for the current user.

I assume that they figured out a way to have a user profile with limited enough rights that it can't read CustomPermissions.

I was able to find ManageCustomPermissions, but I don't want to grant that kind of permission to a normal user.

I tried to see if ReadCustomPermissions was a thing, but when I tried to deploy it, I got the following message back from Salesforce:

Error  deploy/profiles/<managed package name> Standard User.profile  <Managed package name> Standard User  Unknown user permission: ReadCustomPermissions

Does anyone know what the permission is to explicitly allow those users the ability to read the customPermissions?


Update, talking about something I tried shortly after posting this questino:

I found this documentation page https://help.salesforce.com/articleView?id=custom_perms_detail.htm&type=5 that refers to the "View Setup and Configuration" permission. Maybe that is it?

I tried to update the permission set that our standard user is using with the following, based on the documentation I found earlier, but when I sent a beta release of the managed package to the team having the issue, there was no change to the errors they were getting, so that wasn't it.

(snippet from <package name>_User.permissionset-meta.xml)
    <userPermissions>
        <enabled>true</enabled>
        <name>ViewRoles</name>
    </userPermissions>
    <userPermissions>
        <enabled>true</enabled>
        <name>ViewSetup</name>
    </userPermissions>

Update, explaining how we are getting our custom permissions, as requested by comments:

As mentioned in my comment, we are using a class called "CustomPermissionsReader" to read the custom permissions, which can be found here: https://gist.github.com/afawcett/bc482bfdc840d5ac2858

This is how we are using it:

CustomPermissionsReader cpr = new CustomPermissionsReader(Custom_Object__c.sObjectType);
hasMyCustomPermission = cpr.hasPermission('My_Custom_Permission');

I believe the line in question (from the CustomPermissionsReader) where this error is happening is

List<CustomPermission> customPermissions = [select Id, DeveloperName from CustomPermission where NamespacePrefix = :namespacePrefix];
9
  • How is your package accessing Custom Permission information?
    – David Reed
    Jan 9 '20 at 21:53
  • @DavidReed Via apex code. We have a CustomPermissionsReader that accesses it. Jan 9 '20 at 21:58
  • 4
    That's not really an answer. Are you using queries? The FeatureManagement class? Some other mechanism?
    – Adrian Larson
    Jan 9 '20 at 22:00
  • 3
    Could you edit your question to show us what you're actually doing?
    – David Reed
    Jan 9 '20 at 22:47
  • 2
    @RobertHyatt does the native FeatureManagement.checkPermission(apiName) method not meet your needs? Using it may alleviate your pains and not require any additional access to be granted to the user.
    – Mark Pond
    Jan 10 '20 at 17:06
1

Per the CustomPermission object documentation's special access rules section, one of these 4 permissions is required after the Spring '20 release.

Special Access Rules

As of Spring '20 and later, only users who have one of these permissions can access this object:

  • View Setup and Configuration
  • Manage Session Permission Set Activations
  • Manage Users
  • Assign Permission Sets

Using the FeatureManagement.checkPermission(apiName) method should allow checking of permissions without granting elevated permissions to end users.

2
  • This sounds right. I am verifying this now to confirm. Jan 10 '20 at 17:18
  • FeatureManagement.checkPermission(<name of permission>) worked perfectly and didn't require elevating permissions. Jan 13 '20 at 18:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.