4

We are working on a portal app that will run inside a Community and the limited sharing rule capabilities of the lowest priced Communities licenses is making life difficult, particularly as this app is an "add-on" to existing live production orgs. The app does lock down its own access in code by always linking back to and checking the Contact being accessed.

Two alternatives come to mind:

  1. The least likely to be misconfigured approach would be to make all the Apex classes without sharing.
  2. We could also mandate that "View All" and "Modify All" be granted in the profile or permission sets.

If you have experience or insight into how a Salesforce Security review would regard either of these approaches, please post an answer.

1
  • 1
    this is going to be a major PITA to pass through, because Checkmarx will flag every class and you will have to keep adding explanations everywhere. Why not just write classes with sharing but then only call the records user has access to? that won't break anything even for users who have no sharing access, e.g. Chatter Free or High Volume Community
    – zaitsman
    Apr 20 '20 at 12:44
6

Before i begin answering this please note below disclaimer

Do not consider my answer to be official from Salesforce and always schedule an office hour with the security team to get advice on this.

So in my past job, I have encountered this and been able to successfully navigate by scheduling an office hour with Salesforce Security team and walking them through why you need to add such exceptions. Note that if you have a solid business use case on why you need it to be "WITHOUT SHARING" and you write clear explanations and have it properly documented in your false positive documents, you are generally fine.

4
  • 1
    Thanks Mohith - very helpful.
    – Keith C
    Apr 20 '20 at 17:06
  • You are welcome 😊 Apr 20 '20 at 17:44
  • Can you comment on your experience when doing this to avoid SFDC license restrictions? That seems like something beyond just security review. License are cheaper for a reasons. Wondering if "Licenses are cheaper this way" is a solid business case.
    – John
    Apr 23 '20 at 19:04
  • @John Sorry i am not authorized to comment on this. Please do check with your Salesforce AE or TE that you are working on. Thank you Apr 23 '20 at 19:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.