We have an aura component which uses third party javascript library to display an external component in custom tab. We have created admin persona(not system admin) for the application who accesses this tab/page. Javascript library is accessed from static resources.

Issue that we are seeing is: if we access the page with above persona in un-managed code in an org then user is able to access the tab/page. However is same persona/user, tries to access the page in managed package, then user is not able to see this page. There is no changes in the permissions in both the cases.

While looking into browser console, we can see the error related to the javascript library is not accessible in managed package. However when we are giving the Author Apex permission to this persona, it works fine. The javascript library in question uses Visualforce remoting to call apex code.

We are not able to understand why Author Apex permission is required in managed package, while it works fine in unmanaged code. If anybody can provide insights then it will be really helpful.

Thanks in advance!

Update - 28/08/2020 Can someone please provide help? Issue seems to be related to Lightning container component. I have gone through documentation but haven't find anywhere that it would require author apex permission in managed package. https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/container_overview.htm

  • What is the verbatim text of the error?
    – David Reed
    Commented Aug 24, 2020 at 18:43
  • Exact error on browser console is: Uncaught ReferenceError: LCC is not defined at lcc.js:3. However this goes away when we give the author apex permission. LCC is the javascript library we are using, which is stored in static resources.
    – Amit
    Commented Aug 24, 2020 at 18:54
  • 1
    There is a possibility that LCC JavaScript Library has some Metadata Operations that involve creating apex code or other metadata elements. Without knowing the LCC Library contents it's hard to tell whats going on. Commented Aug 24, 2020 at 20:06
  • Thanks Mohith! Do you know why it would happen only in managed package and not in unmanaged code? Permissions are same in both the cases.
    – Amit
    Commented Aug 24, 2020 at 21:30
  • Because Managed package code is a third party code to your org. Is the package certified? Meaning has it gone through sec review? Commented Aug 24, 2020 at 21:34

1 Answer 1


In case anyone else comes across this problem, please be sure that you have given the profiles that you wish to access the lightning-container component / app access to the apex controller defined in the manifest.json file of your LCC application.

Without this permission a critical script will not be injected into the index.html file and lightning-container will not work (unless the profile has the "Author Apex" permission enabled).


  "landing-pages": [
      "path": "index.html",
      "apex-controller": "LightningContainerApexController"

This class must be enabled for each profile you want to access the app:

enter image description here

  • Thanks @no_stack_dub_sack. Is this something documented by Salesforce? When we raised this issue with Salesforce support they said that, it is working as designed(their usual answer to things they dont want to fix) and there is gap in their documentation which they will update.
    – Amit
    Commented May 20, 2022 at 10:37
  • 1
    @Amit This is absolutely not documented by Salesforce, we had to figure it out on our own - at first we were very concerned that "Author Apex" was actually going to be required when we read this post as it did seem to fix the issue, but then we stumbled across this and were quite relieved. When you raised this issue with support they pointed to this as the solution (Apex class access) or said having to enable "Author Apex" was by design? (and perhaps the support people just didnt know that this was another way to fix it - which is typical for support people depending on the level you get) Commented May 21, 2022 at 18:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .