Trying to setup permission sets in communities

Question

I have a specific need where I’m struggling to properly setup the combo between profiles, roles and permission sets. Any insights welcome !

Context

I am setting up a system where our users will interact from a community login. Each user therefore is attached to an account. There can be many users for the same account.

Users from this community will interact on a custom object that we’ll refer to as object__c for simplicity here. object__c contains a lookup field to the account that created it.

Business need

Only the account who created the record for object__c can edit it. However, the account that created the record needs some other accounts to be able to read it and only if they have been given that right.

So I need to setup the combo of permissions, profiles and roles so that:

1. If Account A creates an object__c record, they can retrieve and edit the record.
2. If Account B has been authorised to access the record, they should be able to only retrieve it and read its field values.
3. If Account C was to try and access the record, it wouldn’t show since they have not been authorised to do it. (E.g. if they ran a wide SOQL which returns all object__c records, they should only see their own records + those that they have access to. If A never gave them access, it shouldn’t get returned).

I’m stuck on the right combo of access so any help would help.

What I tried

I started to fix this by creating a junction object that we can refer as ObjectAccess__c. When a user creates an Object__c record, it also creates an associated ObjectAccess__c record which contains :

• the ID of the Object__c record that is authorised (MasterDetail)
• the ID of the Account to which this ObjectAccess__c related (MasterDetail), which is the Account to which the current User from community is attached. In our example, that’s Account A.
• canEdit__c field set to true
• canRead__c field set to true

When the User from Account A wants to share with B, it actually creates a new ObjectAccess__c in the background that will contain :

• the ID of the Object__c record that is authorised (MasterDetail) This is the same record that Account A created.
• the ID of the Account to which this ObjectAccess__c is related (MasterDetail), which is Account B In this example.
• canEdit__c field set to false
• canRead__c field set to true

I am however unable to find the right combo of permissions that will deliver the business need even with that “access” object.

For ref, I’m happy to use some back end logic with Apex if required but I was trying to use everything from the Setup Profiles, Roles and Permissions to ensure it would be secured. Since our system contains hundreds of Accounts and it has sensitive info protected by GDPR, i really must ensure that only Accounts who have been authorised to read the record can do so. And it must all work well with Communities of course since that's how our end users access our system.

Any help and idea welcome. I don’t even have to use the ObjectAccess__c if it’s not relevant. It was just a stab to try and solve.

Thank you!

Answer 1

Sharing Sets seem suitable for your needs. They are configurable rules used to permit community users access to records via an account relationship based criteria.

An example would be: Users with Profile A may access cases where the user's Contact.AccountId is equal to the Case.AccountId. The type of access (read only, read/write) can be set depending on the relationship.

Be sure to set the organisation wide default sharing rules to external private for any object you decide to configure using sharing sets.

See Set Up Sharing Sets for more information about how to get started.