4

When looking for detailed information on how the Salesforce Permission artifacts:

  • Permission Sets
  • Permission Set Groups
  • Custom Permissions

can be best used in Managed Packages (across Base and Extension packages) I found a lot of "Doesn't work as expected" "Should work" etc.

Can you list all the things that work, don't work, should be done, and shouldn't be done? And if that is too broad (sorry) maybe answer those specific questions:

  1. Can I put PermsetGroups in Base and have Extensions add Permsets and CustomPerms?
  2. Can PermsetGroups in Extension re-bundle Permsets and CustomPerms?
  3. Does the overall behavior differ between 1GP and 2GP Packages with a shared namespace?
  4. Can Subscribers of the Base+Extension add, remove from packaged PermsetGroups or Permsets?
2
  • 1
    I will try to guess here a little, but I'd say 1. No. But Extensions can define their own Permission Set Groups. 2. What do you mean by re-bundle? You can't modify component (Permission Set Group) of your base package in extension; outside of that, you can do whatever you want. 3. Not that I know of 4. No. Permission Sets are upgradeable so they're locked for editing by subscriber (help.salesforce.com/…)
    – zaitsman
    Sep 30, 2021 at 7:48
  • Why not make this an answer with a few links to reference material? Sep 30, 2021 at 7:50

1 Answer 1

6

As with many new package components, I test everything in throwaway packages and only rely upon the behavior I can document. For that reason I can answer some, but not all, of your questions. I highly recommend testing with throwaway packages if you have finer-grained questions to which I don't have answers!

Can I put PermsetGroups in Base and have Extensions add Permsets and CustomPerms?

Point of clarification: PSGs do not themselves contain Custom Permissions, but you can add PermSets to them that do.

Extension packages cannot package changes, such as adding a PermSet, to PSGs owned by base packages.

Can PermsetGroups in Extension re-bundle Permsets and CustomPerms?

I believe your question is asking whether Extension PSGs can include PermSets owned by Base packages.

I do not know the answer to this question but will try the experiment in my throwaway packages and update here.

Does the overall behavior differ between 1GP and 2GP Packages with a shared namespace?

I do not know the answer to this question.

Can Subscribers of the Base+Extension add, remove from packaged PermsetGroups or Permsets?

Subscribers can add PermSets and Muting PermSets to managed PSGs. These subscriber changes do not impact, and are unaffected by, your package upgrades.

Subscribers cannot remove packaged PermSets from packaged PSGs.


A few other things I've learned about PSGs and packaging:

  • You cannot change the label of a managed PSG.
  • You can push-upgrade addition of a new PermSet too an existing PSG.
  • You can push-upgrade removal of a PermSet from an existing PSG (it doesn't delete the PermSet, but removes from the PSG).
  • Subscribers can compose your managed PermSets into their own unmanaged PSGs.
  • You cannot delete managed PSGs.
  • You can add unmanaged PermSets to managed PSGs via the Tooling or Metadata APIs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .