0

I have raised a question here regarding how to merge Permission Sets: https://stackoverflow.com/questions/68680012/salesforce-merge-3-permission-sets-into-1

Copied text from above link:

I have 3 'old' Permission Sets (PS1, PS2 and PS3) which need to be merged into a Permission Set #4 (PS4).

PS1, PS2 and PS3 will be deprecated after adding its respective permissions into PS4. PS4 will remain as the future Permission Set which will gather ALL the permissions for a specific set of Users.

For now, I see that this is a very manual task ("Eye-ball" comparing each PS1, PS2, PS3 with PS4 and adding the missing permissions into PS4) and, as all manual tasks, it is prone to errors.

QUESTIONS:

  • Can you suggest a tool to COMPARE Permission Sets to make sure I am not missing any permission? or (even better)
  • Can you suggest a tool to MERGE Permission Sets in a safe way (to mitigate risk of errors)? or
  • Would you recommend a "best approach" or "best practice" for this task?

Can you help?

2
  • 3
    Welcome to Salesforce Stack Exchange (SFSE). I would suggest that you edit your question to include the actual question rather than a link to a SO question.
    – Moonpie
    Aug 6 at 11:17
  • 1
    That was nice of you @Swetha, but I'm of the "old school" mindset that the OP should have done that himself, just as I also think that Keith C should have waited until the OP edited before answering. But I'm also the type that will probably be yelling "Get off my lawn!" in a few years....
    – Moonpie
    Aug 6 at 14:59
1

This answer assumes you are managing the permission sets in a version control system and pushing/deploying changes to your org from your VSCode/sfdx environment.

My current strategy is to have one entry per line in the .permissionset-meta.xml file e.g.:

<objectPermissions><allowCreate>true</allowCreate><allowDelete>true</allowDelete><allowEdit>true</allowEdit><allowRead>true</allowRead><object>Task</object></objectPermissions>

and sort the lines (in e.g. Excel).

That then makes simple file diffs much clearer e.g.:

diff image

and makes copy and paste editing easier too.

4
  • Thank you @sweetha.
    – Eduardo
    Aug 6 at 15:53
  • Thank you @Keith.
    – Eduardo
    Aug 6 at 15:57
  • In VSC & SFDX, I could see that the Permission Set XML files (.permissionset-meta.xml) where not containing ALL the relevant information. Therefore, I have edited the file package.xml stored in the folder manifest and have injected the following lines: <types> <members>*</members> <name>PermissionSet</name> </types>
    – Eduardo
    Aug 6 at 16:00
  • 1
    After doing that, I have retrieved Source in Manifest from Org and re-checked the Permission Set XML file: it now contains ALL the information I was looking for. I can now use editor.mergely.com to compare both and merge the permissions.
    – Eduardo
    Aug 6 at 16:05
1

The Heroku (free) app PermComparator is quite useful. It can compare up to 4 PS at once, highlighting common, differing, and unique permissions

Here's a screen shot

enter image description here

0

consider a solution in code. Using the local XML files, many languages (python, C#) could read from a PermissionSet 1,2, and 3, and insert into PermissionSet #4 if an element is not there. The result would a combined XML file that is ready to deploy (I'm over simplifying a little, but it is definitely possible).

In Apex, you could do something similar. See for example theses posts on DML for field permissions: https://developer.salesforce.com/forums/?id=906F00000005HTsIAM

https://patlatus.wordpress.com/2017/02/16/salesforce-use-apex-code-to-grant-permissions-to-custom-object-and-fields/

The steps would be:

  1. SELECT the existing FieldPermissions for the target permissionSet
  2. SELECT the Fieldpermissions from one of the source permissionSets. 3. Loop through the source fields. For each fieldPermission in the source, if it does not not exist in the target, add it to a list.

You can do that for each of the many source permissionSets. Then, insert your list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.