0

Is it possible to restrict records (like Orders) created by Community Login Users in a Community Site for different Sharing Groups?

I'm still very new to the concept of Sharing Groups. Currently, we are using only one Community Site for our Community Login Users to connect. However, in the future, our client has plans to expand the solution we made to other subsidiaries in their company.

This would mean we will create a new Community site for these other subsidiaries in the future. My worry, however, is that since we gave a certain Group access to records created by Community Login Users via the Sharing Group, they will also have access to records to other subsidiaries which is a big NO NO for us.

Example:

Correct

Subsidiary A --- Must only Access ---> Community Site A records

Subsidiary B --- Must only Access ---> Community Site B records

Not Correct

Subsidiary B --- can access ---> Community Site A records

Subsidiary A --- can access ---> Community Site B records

Again, is there a way to restrict records in different Community Sites for different Sharing Groups?

Thanks.

3
  • was it sharing group or sharing set? Sharing group would be just for high volume portal users? Jun 1, 2021 at 12:03
  • It's sharing group. We created a sharing group and now the users inside that group can see the records created by the Community Login Users. Jun 1, 2021 at 12:05
  • Have you tested this out or are you planning on using different profiles for different communities? The sharing set will specify, for a given profile, how access is determined...is that not enough to ensure user from Subsidiary A only see orders related to their Subsidiary? (ex. User account matches order account)? Jun 25, 2021 at 14:19

2 Answers 2

0

Here is the best resource I found from Salesforce itself explaining how Share Sets work. It doesn't go into super deep detail but some of the things to know about sharing sets are:

  • An external profile can only have 1 sharing set (This is not apparent until you go to create a second sharing set and any profiles that already have a sharing set are unavailable for selection)
  • That sharing set can only have 1 "sharing mechanism" per object (example: share all cases where accountID = user's contact's account ID - you cannot say something like "share all cases where case accountId = user's contact's account's ID OR user's contact's account's parent account's ID" without additional customization
  • In the background what happens is that the Share Group becomes a Salesforce Group (just like any other group you define or users within a role in the role hierarchy), as do users within profiles associated to that sharing set. Then you can think of the next step like an ownership based sharing rule that read's something like "if owner is a part of sharing set X, share this record with Sharing Set X's Share Group." I recommend this article if you haven't read it yet to get a feel for how Salesforce handles sharing on the back-end, although it does not specifically talk about sharing sets.

What that means for you is: even if your new user group is within the same community, as long as all of the users have different profiles which are associated to different Sharing Sets, internal users will only see the records from the "correct" users in your use case.

Note that in the Share Group setup page it does specify that members are granted access to records "owned by portal users in the associated sharing set" Set-up

0

Expanding on answer from brezotom you can achieve the desired result by doing the following:

Create a separate profile for each community that will be assigned to users of each community.

Community Site A ---> CustomeProfile_SiteA

Community Site B ---> CustomeProfile_SiteB

Since sharing group is linked to sharing sharing set which in turn is linked to profile you will now have a separate sharing group for each community.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.