0

I am trying to validate the OWD for an object that is Public/Read Write without Read permission at the object level for a specific profile user. To validate the results I created a new profile by cloning the sys admin profile without read access for that object and created a permission set with 'view of Data' system permissions.

By granting the 'View All Data' it enables the Developer Console permission.

To validate the above-said scenario,

  • Assigned the permission set and cloned 'sys admin' profile to a user.
  • created an apex class with 'with sharing' to query the object.
  • Executed the apex class by login as a new user in the dev console.

The question is, the query is returning all the records even if the user doesn't have read access to the object. Is it becuase of the OWD is 'public/read write' or the system permission 'View All Data' is granting access to all the objects in the org?

Improve this question

1 Answer 1

Reset to default
0

"with sharing" only considers the sharing tables, not profile permissions. Use the WITH SECURITY_ENFORCED feature to also consider profile permissions.

Improve this answer
1
  • @sfdxfox - Got it. The mistake here is , I shouldn't use the cloned sys admin profile for sharing validation. Validated the above said scenario as regular profile and test class(runAs)
    – indrasen neelam
    Aug 27 at 19:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .