0

I have a without sharing apex class, which gets called from a flow.

Inside that apex class I'm trying to change the role of a portal user, the flow gets invoked when portal user changes something on the contact record.

Even though my apex class is without sharing I'm still getting below error:

FIELD_INTEGRITY_EXCEPTION, field integrity exception: UserRoleId (dpua portal user cannot change user role): [UserRoleId]

global without sharing class UpdateUserRole {

    @InvocableMethod(label='Update Role')
    public static void updateRole(List<string> userId){
        
        UserRole ur : [SELECT Id,PortalAccountId FROM UserRole WHERE PortalAccountId = '0013400001KuaiTAAE' AND PortalType = 'Partner' AND Name like '%Manager' limit 1];

        
        List<User> userRoleToUpdateList = new List<User>();
        User us = new User();
        us.UserRoleId = ur.Id;
        us.Id = userId[0].Id;

        userRoleToUpdateList.add(us);
        
        update userRoleToUpdateList;
    }
}

1 Answer 1

0

This is a security restriction that is put in place to prevent portal users from making unauthorized changes to the system.

To fix the error, you can either:

  1. Remove the without sharing keyword from your Apex class. This will allow the portal user to change the user role of another user, but it is important to note that this could have security implications.

  2. Change the logic of your Flow so that it does not call the Apex class when a portal user changes something on the contact record. For example, you could use a different Flow to update the user role of the contact owner.

Here is an example of how to change the logic of your Flow so that it does not call the Apex class when a portal user changes something on the contact record:

  1. Create a new Flow that is triggered when the contact record is updated. Add a condition to the Flow to check if the user who updated the record is a portal user.
  2. If the user is a portal user, then do not call the Apex class. Otherwise, call the Apex class to update the user role of the contact owner.

Here is an example of a Flow rule that you could use:

Trigger: Contact
Rule Criteria: Record has been updated

Elements:

  • Decision: Is user a portal user?
    • Yes: Do nothing
    • No: Call Apex class to update user role of contact owner

This Flow will only call the Apex class to update the user role of the contact owner if the user who updated the contact record is not a portal user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .