0

I'm building a community in which new users (Accounts) are assigned to a given Partner after the signup. Hence, the Partner takes ownership of the account.

New users must provide additional information after the signup. This is done by showing a Flow in the community's landing page. This flow should then update the user's account with the given information.

The problem is that the account is not owned by the new user, but by the Partner, so attempts to update the user's Account information within the flow fail:

Error element update_address (FlowRecordUpdate). The flow tried to update these records: null. This error occurred: INSUFFICIENT_ACCESS_OR_READONLY: insufficient access rights on object id. [...]

I'm aware I could ask for all required information within the initial signup-form but I would like to avoid that to keep that form as simple as possible.

So I would like to know the best way to allow users to update their own Account information without messing too much with account ownership or organization-wide sharing settings.

NOTES:

  • Person Accounts are activated in my org.
  • I'm currently working around this by setting the Sharing Settings for the Account object to "Public Read/Write" for internal and external access, which surely is not a good practice.

Thanks in advance

Improve this question

2 Answers 2

Reset to default
1

You can set the OWD for Account to be Private and add criteria based Account Sharing Rule.

You can use Record Type for criteria (or any other field that uniquely identifies such Account records for Community users).

For example, the below sharing rule shares the Account records with all Custom Portal Community users.

enter image description here

Improve this answer
5
  • Thanks, Prakhar. Makes sense but when I do so I get the INSUFFICIENT_ACCESS_OR_READONLY error, even if I use a more generic approach (Account: owned by members of All Internal Users / Share with All Customer Portal Users).
    – Eduardo López
    Jul 23, 2020 at 13:02
  • What's the profile of the user running the flow? Can you check if the profile has Read and Edit Access to the Account object?
    – Prakhar Saxena
    Jul 23, 2020 at 13:15
  • The profile would be Customer Community User and it has no Edit access to the Account object. Nevertheless, digging a bit more into the advanced settings of the flow, I came across the "How to run the flow" option. There you can choose between several permission settings and even enable full data access, thus removing the need of modifying sharing or profile settings. Unless there are security concerns, this would be the easiest way, isnt it?
    – Eduardo López
    Jul 24, 2020 at 16:35
  • Yes, you can select the option System Context Without Sharing -Access All Data under How to Run the Flow. However, this would just give access to all the records (Record Level Security). It will not change any Object or Field Level Security. If you still get the same error after enabling this, that means it's an Object level or Field level security issue. You need to give Read and Edit Access to the Account object and also Edit Access for fields (if you are updating any) for the running user profile.
    – Prakhar Saxena
    Jul 25, 2020 at 4:36
  • I can confirm that after setting the value to "Access All Data" the flow works as expected, so I guess the flow configuration overrides the sharing settings in this case.
    – Eduardo López
    Jul 27, 2020 at 15:53
0

The Field "How to run the Flow" under the advanced Flow Settings defines which resources will be available when the flow is executed:

  • "System Context with Sharing - Enforces Record-Level Access" takes into account sharing settings when running the flow (defined as per Prakhar's anwser).
  • "System Context Without Sharing - Access All Data" ignores sharing settings and allows full access to the object(s) used in the flow.

Best practice, in this case, would be to use "System Context with Sharing" and define specific sharing settings for the Account object.

enter image description here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .