I have a custom object called Banner that I'd like to allow portal users to view and portal administrators to create/edit all records. Currently the admin can create, edit, delete their own records, but not others. I have setup a sharing rule with that should allow members of the "VMS admin" public group Read/Write access, but it doesn't appear to be working.

How do I share all records of a certain type with a particular user/group/or permission set?

Here's my configuration:

The user, VMS admin is assigned the "Employee Portal Approval" profile and is assigned to the VMS Admin public group. The Employee Portal Approval profile has a Customer Community Plus license with CRUD permission on their own banner records.

banner custom object permissions

The Banner object,

  • OWD are set to Internal Public Read Only, External Public Read Only
  • Sharing Rules allow members of the VMS admin group Read/Write access on records with certain field values. Banner object sharing rules

The following is an apex test class. The adminCanEdit method fails with the error, "INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, insufficient access rights on cross-reference id"

    //Test 3 - VMS admin can add banners
    public static void adminCanCreateEdit(){
        //vmsAdmin_user belongs to the public group "VMS admins"
        User vmsAdmin_user = [SELECT Id from User WHERE username='VMSadmin@email.com' LIMIT 1];

            Banner__c b1 = new Banner__c(
                application__c = 'vms',
                Title__c = 'test3-11232jkljf',
                Message__c = 'Test insert record on test3-11232jkljf',
                Start_Date__c = Date.newInstance(2022, 3, 3),
                End_Date__c = Date.newInstance(2022, 12, 9)
            insert b1;
            b1.Message__c = 'The VMS admin can change their own banner';
            update b1;
        List<Banner__c> result = [SELECT Id, Message__c, application__c, Start_Date__c FROM Banner__c WHERE Title__c = 'test3-11232jkljf'];
        System.assertEquals(1, result.size(), 'could not find one record');

    //Test 4 - VMS admin can update banners
    public static void adminCanEdit(){
        User vmsAdmin_user = [SELECT Id from User WHERE username='VMSadmin@email.com' LIMIT 1];
        String newMessage = 'The VMS admin should be able to update this banner.';

            List<Banner__c> t4result = [SELECT Id, Message__c, application__c, Title__c FROM Banner__c WHERE Title__c = 'Banner1'];
            t4result[0].Message__c = newMessage;
            update t4result;
        List<Banner__c> result = [SELECT Id, Message__c, application__c, Start_Date__c FROM Banner__c WHERE Title__c = 'Banner1'];
        System.assertEquals(newMessage, result[0].Message__c, 'The message was not updated.');

Similar question, but not quite... Sharing Rule is not granting access to a public group

1 Answer 1


Are you running into the same problem with functional tests?

Unfortunately, criteria-based sharing rules do not apply in a unit test context. OWD Sharing Settings do apply in tests, however.

To work around this in your tests, you may have to create a manual share record as part of the test to imitate the expected access from the sharing rule.

  • Good to know testing won't work.
    – Dave
    Mar 8 at 15:12
  • I am testing this with a lightning web component. Users in the VMS Admin group are not able to delete other user's Banner records. The lightning web component uses the deleteRecord API. After further investigation, I realize VMS admin users can edit the record just fine, though it seems they still can't delete it. The sharing rule only allows Read/Write. Is it possible deleting a record is not allowed?
    – Dave
    Mar 8 at 15:20
  • 1
    According to this, sharing rules may not grant delete access to records owned by other users. However, the user can change the record owner. So, maybe a custom apex that changes the record owner then deletes the record?
    – Dave
    Mar 8 at 15:28
  • Good callout about delete - have run into that same exact issue a few times. This article is helpful to have on hand for delete: help.salesforce.com/s/articleView?id=000327316&type=1 " There are three scenarios in which a User can delete a record: * The User trying to delete the record is the owner. * The User is higher than the owner in the owner's role hierarchy. * The User trying to delete the record has the 'Modify All' permission. " An ownership change is certainly an option, but be careful about the side effects from changing ownership like clearing existing shares Mar 9 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.