1

We are testing the use of the new Integration License for API use. enter image description here.

We have been using the Admin license for our portal, which automatically gets assigned permissions to any new classes that are created, but are switching to the new license as it frees up a paid license.

With the switch to the new free integration user profile, however, any new classes are NOT assigned permissions automatically. This is causing issues as developers are forgetting to do the class permission assignment for the api user.

Is there any way to set this on the class when it is created, rather than having to remember to go to either the profile and add it there, or to the class in the list of classes under Custom Code and click on the Security link? Or to set this profile as being updated with permissions as admin (in our case it requires access to all classes)?

I don't want to have to go into the orgs after deploying new classes and set this manually on the profile each time. I know I can create a permission set for the profile, but again, it has to be maintained manually, so there's still the problem of a dev forgetting to do so.

1
  • You should not be assigning permissions to this Profile; you should assign permissions to a Permission Set used by one or more of the users of this Profile. sfdcfox solution is a good one. The Profile will be used by many (over time) integration users with wildly different use cases. Apex class permissions are really only needed for selected use cases (e.g. web services, apex rest, selected experience cloud use cases)
    – cropredy
    Dec 1, 2023 at 18:52

1 Answer 1

2

Users with Author Apex ignore Apex Class access permissions. That's why Apex Code will always run for those users. You can't have a trigger or something to respond immediately to changes. Further, you can't just give the Salesforce Integration license type Author Apex. However, you could write a script to automate this.

Example:

public class AssignPermissionsForClasses implements Schedulable {
  public void execute(SchedulableContext context) {
    PermissionSet integrationPermissionSet = [
      SELECT Id FROM PermissionSet WHERE Profile.Name = 'Integration User'
    ];
    ApexClass[] classes = [SELECT Id FROM ApexClass];
    SetupEntityAccess[] seas = new SetupEntityAccess[0];
    for(ApexClass klass: classes) {
      seas.add(
        new SetupEntityAccess(
          ParentId=integrationPermissionSet.Id, 
          SetupEntityId=klass.Id
        )
      );
    }
    // Silently ignore failures.
    Database.insert(seas, false);
  }
}

Schedule this to run hourly or whatever. It'll make sure that any classes that aren't assigned to the user will be within the next hour.

You could also write this as a script to run in Execute Anonymous (just take out the first and last two lines of code), or as a SandboxPostCopy script, etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .