0

According to documentation ObjectPermissions represents only enabled object permissions for parent permission set. Permission set license determines which objects are associated with parent permission set but after digging the web I can't find out any possible way to get that information. Is it possible to get all permissionable objects associated with Permission Set?

Example:

Following Query returns only enabled permissions (at least PermissionsRead = true).

    SELECT 
        SObjectType, 
        PermissionsRead, 
        PermissionsCreate, 
        PermissionsEdit, 
        PermissionsDelete, 
        PermissionsViewAllRecords, 
        PermissionsModifyAllRecords 
    FROM ObjectPermissions
    WHERE Parent.Profile.Name = 'Read Only'

Results:

enter image description here

Records like below isn't stored to avoid redundancy and it is totally understandable.

enter image description here

I need to find that missing records or at least SObjectType names somehow. I hope it is clear enough.

I stumbled upon an article from Bill Appleton (CTO at Metazoa) about The Sparse Profile Problem and I wonder how they determined which of the negative values needs to be added by hand.

2
  • please use edit and give an example of what you are looking for
    – cropredy
    Apr 15 at 16:29
  • Question updated @cropredy.
    – gpoluch
    Apr 16 at 7:30
2

I believe you are actually asking "how do I find all the objects for which the Permission Set doesn't have access?" As you pointed out, ObjectPermissions won't return objects on which the Permission Set has absolutely nothing enabled. Consequently, in Apex, you will need to collect all objects by using Schema.getGlobalDescribe(), query and loop through the ObjectPermissions to get accessible objects, and remove the current object from the collection of all objects so by the end you are left with only disabled objects.

Be aware that Schema.getGlobalDescribe() returns all kinds of different system objects, so you'll probably want to somehow filter down which objects you want to check access on before adding to disabledObjects.

Code:

// Get collection of all sObjects
Set<String> disabledObjects = new Set<String>();
for (String objName : Schema.getGlobalDescribe().keySet()) {
    disabledObjects.add(objName);
    System.debug('Sobject Label Name: ' + Schema.getGlobalDescribe().get(objName).getDescribe().getLabel() );   
}
// Get enabled objects from Permission Set
List<ObjectPermissions> permissions = [SELECT 
        SObjectType, 
        PermissionsRead, 
        PermissionsCreate, 
        PermissionsEdit, 
        PermissionsDelete, 
        PermissionsViewAllRecords, 
        PermissionsModifyAllRecords 
    FROM ObjectPermissions
    WHERE Parent.Profile.Name = 'Read Only'];
// Remove enabled object from disabled objects collection
for (ObjectPermissions op : permissions) {
    disabledObjects.remove(op.SObjectType);
}
2
  • 1
    Filter 'Somehow' worries me the most. Here it is an idea how to get all permissionable objects salesforce.stackexchange.com/questions/255567/… but get list in context with current User and some objects are missing.
    – gpoluch
    Apr 19 at 3:45
  • 1
    I agree it's a tricky one. For another project, I initially tried to figure out User-interactable standard objects by doing similar things to that post you linked to, but realized there were some many edge cases that it was just easier to hardcode the standard objects I cared about and only get custom objects dynamically. Since standard objects change infrequently and only during major Salesforce releases, I think that's a good enough strategy. Apr 19 at 12:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.