1

Search is enabled on external objects in the community. What setup needs to be done so as results returned are specific to the logged in user?

Based on what I researched so far I think: When external data source is created in Salesforce,  in the Authentication section,  the identity type  should be Per User rather than named principal. I am assuming based on this some work needs to be done in the provider source to filter the results based on user. Please let me know if I am thinking this correctly.

0

It depends on what you mean by "specific to the logged in user" or how specific is specific.

Search is filtering results based on standard Salesforce data access framework. There are 4 levels of granularity in this framework. From one of the Trailhead tutorials, these levels are:

Organization

At the highest level, you can secure access to your organization by maintaining a list of authorized users, setting password policies, and limiting login access to certain hours and certain locations.

Objects

Object–level security provides the simplest way to control which users have access to which data. By setting permissions on a particular type of object, you can prevent a group of users from creating, viewing, editing, or deleting any records of that object. For example, you can use object permissions to ensure that interviewers can view positions and job applications but not edit or delete them.

Fields

You can use field–level security to restrict access to certain fields, even for objects a user has access to. For example, you can make the salary field in a position object invisible to interviewers but visible to hiring managers and recruiters.

Records

To control data with greater precision, you can allow particular users to view an object, but then restrict the individual object records they're allowed to see. For example, record–level access allows interviewers to see and edit their own reviews, without exposing the reviews of other interviewers. You can manage record–level access in the following ways.

The first 3 levels are available for implementing access control for external objects in the subscriber SF org (the org receiving the data from external data source). For example, if you grant access in subscriber org to some external object Blah + field Foo to user A and grant access to the same external object Blah + field Bar to user B, the search results user A will see are going to be different from results seen by user B. The results will be specific to each user.

Record-level access control is not available in subscriber org for external objects. The linked doc mentions sharing rules as the only mechanism that is not available. SF has more implementation options for record-level access control such as role hierarchy...but none of these options are available. Record-level access control has to be implemented either by the Salesforce Connect adapter or by the provider service (the external data source).

Will you be able to achieve record-level access control by passing the identity of a logged-in user via external data source with per-user identity? Yes, that would be a prerequisite and step 1 of the journey. The end result will depend on your SF Connect adapter and target (external) data source.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.