1

By default, the Salesforce Integration User Licence doesn't provide access to a variety of standard objects (including Contacts and Accounts).

You can extend the access for an integration to those objects by using the Salesforce Integration API Permission Set License AND a custom permission set, as helpfully explained in accepted answer to this question.

Essentially:

  1. Create a user with the Salesforce Integration User Licence,
  2. Apply the Salesforce API Only System Integrations profile,
  3. Assign the Salesforce API Integration Permission Set Licence, then
  4. Create a licence independent permission set that grants (READ, Object-Level) access to those objects.

This is all explained in the above question.

The problem is that the permission set created in step 4, had no field level access - BUT when testing, the integration user has read access to ALL the fields on the object.

Using Salesforce's User Access & Permission Assistant permission explorer, you can see that the object level access is granted by the Permission Set but the field level access is granted from the Profile (which you can't view or remove).

Is there any way you can use the Salesforce Integration User Licence while restricting access to specific fields?

(I've considered masking field level access with permission set groups, but there must be a simpler way?!)

4
  • integration user has read access to ALL the fields on the object. - access via the REST API or via some Apex program that the integration user invokes?
    – cropredy
    Aug 9, 2023 at 1:19
  • 1
    @cropredy : using REST API (A query executed via Salesforce's Postman API set returns every field on the object) Aug 9, 2023 at 1:29
  • On standard objects, required fields are always visible (like Contact.LastName, Contact.Name) but I presume you are fetching more fields than those
    – cropredy
    Aug 9, 2023 at 3:46
  • 1
    You cannot edit Object-Level permission, but you can change Field-Level ones. Moreover you could clone the profile. Anyway, as cropedy said, you cannot remove read/edit permission from required fields.
    – RubenDG
    Aug 9, 2023 at 8:14

1 Answer 1

1

If you modify the Salesforce API Only System Integrations profile the normal way - through Setup in the Salesforce UI, you can't set field level permissions for some of the standard objects (like Contacts).

However, these permissions can still exist on the profile.

If the profile does explicitly set read or edit rights for field (but not the object), but a permission set that grants object level access is also applied - then those fields will become available. This is what happened in my case.

While you can't fix this via the UI, you can use the Salesforce CLI (using the approach described by @kai-tribble in this answer), to retrieve the profile metadata xml - with the field permissions that exist on the profile, but can't be viewed or edited via the GUI.

The manifest file (package.xml) must contain the profile AND the objects/custom fields for which the profile references e.g.

<types>
    <members>*</members>
    <name>CustomField</name>
</types>
<types>
    <members>*</members>
    <name>Profile</name>
</types>

This will retrieve profile xml which will contain all the fields that were not visible in the GUI, looking something like this:

<fieldPermissions>
    <editable>false</editable>
    <field>CustomObject__c.CustomField__c</field>
    <readable>true</readable>
</fieldPermissions>

You can then modify the fields in the XML (set to true/false) and the push/deploy the XML back into the salesforce instance.

I highly recommend using the Salesforce Permission Set Explorer for diagnosing this kind of issue.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .