4

I'm having trouble assigning a permission set to the Automated Process User. I followed this guide from UnofficialSF, which worked for me before, but for some reason it's not working now for this Org.

I can't find the Automated Process User as usual, in this org it's called Platform Integration User, and there are multiple users with the same name, but I got it because the username is autoproc@00d....

Anyways, when I try to assign the permission set like the guide says,

String automatedProcessUserId = '0057R00.....';
PermissionSet ps = [SELECT Id FROM PermissionSet WHERE Name = 'MyPermissionSetName' LIMIT 1];
insert new PermissionSetAssignment(AssigneeId = automatedProcessUserId, PermissionSetId = ps.Id);

I get this beautiful error:

CUSTOM_TAB_LIMIT_EXCEEDED, Can't complete this operation because it would exceed the number of custom tabs allowed by the user license."

Has anyone else run into this and figured out how to fix it?

Edited:

The requirement for this change is to allow the Automated Process User (or Platform Integration User), to access new Named Credentials when it's executing from a Platform Event Trigger.

Instead of assigning a permission set to the Automated Process User, I changed the running user for the Subscribed Triggers by using the PlatformEventSubscriberConfig metadata element. This will allow the platform event subscriber to access the Named Credentials via the new running user that has the required permissions.

The PlatformEventSubscriberConfig element needs to be created with VSCode and deployed to the target Org, we cannot change this in the setup, and we need the username to exist in the destination Org, so it will not be automatically fixed when deploying from one Sandbox to another.

It's important to take into account that this configuration need to be done in the destination org, also, the user that you are going to use needs to exist in that org.

4
  • The Automated Process user is always called the Automated Process user as far as I know...
    – Phil W
    Commented Jan 19, 2023 at 20:20
  • Does the perm set include any permissions/settings that are unnecessary for what you are doing? Just wondering if it has some custom tab related details in it that cause this issue when combined with what the target user already has...
    – Phil W
    Commented Jan 19, 2023 at 20:22
  • The permission set I'm trying to add is an empty permission set, without specific license, I'm trying to grant access to a new style Named Credential Commented Jan 20, 2023 at 9:46
  • 1
    The permission set I'm trying to add is an empty permission set to grant access to a new style named credential. I'm actually trying to assign that permission set to this user because it's the user who runs the Platform Event Trigger, and I need to make some callouts from that trigger. After reading a few I found that I can use a PlatformEventSubscriberConfig to change the running user of the trigger to an user who I can assign the needed permission set, and even set the trigger batch size. Commented Jan 20, 2023 at 10:25

3 Answers 3

3

The actual requirement is to allow the Automated Process User to access new Named Credentials when it's executing from a Platform Event Trigger.

Instead of assigning a permission set to the Automated Process User, I changed the running user for the Subscribed Triggers by using the PlatformEventSubscriberConfig metadata element. This will allow the platform event subscriber to access the Named Credentials via the new running user that has the required permissions.

The PlatformEventSubscriberConfig element needs to be created with VSCode and deployed to the target Org, we cannot change this in the setup, and we need the username to exist in the destination Org, so it will not be automatically fixed when deploying from one Sandbox to another.

It's important to take into account that this configuration need to be done in the destination org, also, the user that you are going to use needs to exist in that org.

To create the file in your VSCode project

  1. Create a folder with the path force-app/main/default/platformEventSubscriberConfig
  2. Create a file for the PlatformEventSubscriberConfig XML with exactly the same name as you Platform Event Trigger

MyPlatformEventTrigger.platformEventSubscriberConfig-meta.xml

<?xml version="1.0" encoding="UTF-8"?>
<PlatformEventSubscriberConfig xmlns="http://soap.sforce.com/2006/04/metadata">
    <platformEventConsumer>MyPlatformEventTrigger</platformEventConsumer>
    <batchSize>200</batchSize>
    <masterLabel>MyPlatformEventTriggerConfig</masterLabel>
    <user>[email protected]</user>
    <isProtected>false</isProtected>
</PlatformEventSubscriberConfig>

The trigger

trigger MyPlatformEventTrigger on MyPlatformEvent__e(after insert) {
  new MyPlatformEventTriggerHandler().run();
}

Doing this will also allow you to

  • Specify the Batch Size for your trigger, default is 2.000
  • Executes the trigger with sharing, if you want to enforce sharings for the running user.
  • Send Email from the trigger, which is not allowed for the Automated Process
1
  • Great explanation, and this is exactly what I also did in several projects with similar requirements. However, I want to add an important step. After you have set up the PlatformEventSubscriberConfig, you also need to set the actual trigger inactive, deploy that, and then set it active again (and deploy that too). This step is crucial to make the PlatformEventSubscriberConfig work as expected. This additional step ensures that the configuration is properly recognized and applied by the system in the target Org.
    – derroman
    Commented Jan 3 at 15:02
1

I was encountering the same error, but found that after deleting the Knowledge tab from my org, I was then able to save the permission set assignment without error.

I found a reference to this error in this Salesforce knowledge article that suggested deleting the tab.

After deleting the tab, and assigning the permission set, I was able to recreate the Knowledge tab again without issue.

0

I just created a blank permission set with only access to external credentials and could assign it to the automated process user

1
  • This seems like it would be more appropriate as a comment (but you're not quite at the point where you can leave comments). General advice is to contribute on questions that don't require you to make comments until you reach that 50 rep point threshold.
    – Derek F
    Commented Apr 24 at 13:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .