1

My AppExchange app passed security review last week, and I am about to release it.

One final question I haven't had luck finding an answer to is whether to include the 'Admin' profile (that grants class access, app visibility, and user permissions for the app's components).

When deploying to my scratch org, I have found that I needed this profile for the app to be visible to my scratch user. Alternatively, I think I could also do this the way e-bikes does it, by having a permission set that I assign to the default user via the CLI. However, when installing via Appexchange, it sounds like the customer will have the ability to choose 'Full Access'.

Since this is the case, should I delete my admin profile (Admin.profile-meta.xml) from the package before deploying?

A related question, I have 1 custom field that I would like to be read only for the whole customer organization. Is there a way to override 'Full Access' and enforce this?

1 Answer 1

2

I generally advise against including any Profiles in a managed package. The semantics of how Profiles are handled on install are deeply confusing:

  • If the user installs interactively, they map your packaged Profiles to their own Profiles (the packaged Profiles aren't simply installed in their org).
  • If the user installs via the API, like with the sf cli, packaged Profiles just vanish. They're not delivered at all.

I think I could also do this the way e-bikes does it, by having a permission set that I assign to the default user via the CLI.

This is my recommendation. Note that there are limitations on the specific permissions you can package.

However, when installing via Appexchange, it sounds like the customer will have the ability to choose 'Full Access'.

Yes, they will. You cannot change that, but you can recommend against it.

A related question, I have 1 custom field that I would like to be read only for the whole customer organization. Is there a way to override 'Full Access' and enforce this?

At the FLS level, no. You would have to enforce this via custom Apex in your package.

5
  • Great, thanks for the quick response. Since my app needs no 'admin' profile and to avoid a complex installation process w/ mapping and permission set assignments, I think I will just avoid all profiles and permission sets, and encourage 'Full Access' install. Then enforce the read-only field in apex like you mentioned. Thank you!
    – louis
    Commented Apr 30 at 19:03
  • 2
    IMHO, you really should think about providing "feature-based" perm sets (basic and admin for each "feature") this allowing personas to be created as perm set groups, using different features together. What a feature is depends on the scope of your package. NB: if you want to mandate read only, you would have to use Apex trigger based logic; this cannot be deactivated by the subscriber unlike things such as validation rules.
    – Phil W
    Commented Apr 30 at 19:55
  • Yes that make sense, thank you for the advice. I think I will do that in the future. It's just that as of now, the app is just a dashboarding tool, and there is nothing that I can think of (no custom metadata types/custom settings/etc.) that a base user shouldn't have access to but an admin should. The only difference between users is row and field level security, which is enforced but obviously doesn't need any additional permission sets to work. Is there something I might be missing that would justify creating an admin permission set?
    – louis
    Commented Apr 30 at 20:48
  • To clarify, I only have two user profiles I've thought of that are necessary to get the app working. One, the installer, a user with “Download AppExchange packages” permission. And two, the user, who has been given 'Full Access' by the Installer via the Appexchange install process.
    – louis
    Commented Apr 30 at 20:52
  • 1
    OK, so have a "package user permset" to allow use of your dashboard with minimum possible CRUD/FLS for it to provide meaning.
    – Phil W
    Commented May 1 at 6:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .