34

If I know the name of a certain profile, I would like to obtain CRUD permission settings for each object in the profile using Apex.

I see that there is an sObject called Profile, but this only reveals the boolean values of permissions such as Edit Case Comments, or Transfer Cases etc.

There is another sObject called ObjectPermissions which you can get this info from, but this is only for Permission Sets and not for Profiles.

I would like to determine whether a certain profile can read and edit Case records just as the ObjectPermissions sObject allows you to do for Permission Sets.

Is this possible?

Thanks

2 Answers 2

40

Actually, the PermissionSet SObject has a field in it called IsOwnedByProfile. Take a look at this blog post by Adam Torman, http://blogs.developerforce.com/engineering/2012/06/using-soql-to-determine-your-users-permissions-2.html:

This field determines whether a permission set is a custom one or if it is parented by a profile. This is made possible because for every profile, there is one underlying permission set. That way, permissions layer equally across permission sets without having to treat a profile differently.

So, if you want to find the CRUD permissions of a profile you can do something like this:

SELECT Id, SObjectType, PermissionsRead, PermissionsCreate
FROM ObjectPermissions
WHERE parentid in (select id from permissionset where
PermissionSet.Profile.Name = 'System Administrator')
7
  • Nice one Daniel, I was searching for this myself, since the question relates to know what is set on a profile rather than the current users permissions. Was about to break out the Metadata API from Apex! ;-) Oct 28, 2012 at 20:19
  • 2
    That's great. Thanks Daniel. I wondered why I was getting so many permission sets returned when I was playing around with some SOQL queries before. I will try and put this to good use.
    – Joe
    Oct 29, 2012 at 21:01
  • Awesome Daniel! Thanks for the call out as well!! Please keep in mind that accessing PermissionSetAssignment, PermissionSet, ObjectPermissions, FieldPermissions, or SetupEntityAccess for a Profile is read-only - you can't update these permissions or assignments using Permission Sets that are owned by profiles. Nov 30, 2012 at 0:36
  • Great post! I note that if you use profile 'Read Only' in the subquery's where clause, you will not get back any ObjectPermissions for SObjects other than Account, Case, Lead, Opportunity and a few others. No custom SObjects at all.
    – cropredy
    Aug 6, 2013 at 22:28
  • @crop1645 - did you find that on any other profiles other than 'Read Only'? Sounds like a bug if it's isolated to just that one profile. Oct 25, 2013 at 17:35
7

Doing this is pretty much possible both in Apex and Visualforce code. The platform gives rich describe information and shorthands which check the current user's CRUD or FLS permissions.

Here are few code snippets

To know if few fields are accessible

<apex:outputText value="{!accountBillingAddress}" rendered="{!AND($ObjectType.Account.fields.BillingCity.Accessible, $ObjectType.Account.fields.BillingState.Accessible)}"/> 

To check the same in Apex code

     if (Schema.sObjectType.Account.fields.BillingCity.isAccessible()
          &&
        Schema.sObjectType.Account.fields.BillingState.isAccessible()  
        ){ }

Similarly individual objects can be checked as well, for ex:

<apex:relatedList list="Contacts" rendered="{!$ObjectType.Case.accessible}"/>

This guide has lot of rich details about secure coding guidelines for further reading: http://wiki.developerforce.com/page/Secure_Coding_Guideline

Source : VF Dev guide (http://www.salesforce.com/us/developer/docs/pages/Content/pages_controller_std_checking_accessibility.htm) and Developer force WIKI

1
  • Describe calls (from Apex or VF) work only for current $User. Given that OP is talking about name of given profile I don't think he wants to use it only for current user...
    – eyescream
    Oct 28, 2012 at 19:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.