how to make object read only without using profiles or permissionset?

Question

how to make object read only without using profiles or permissionset?? Is there any setting or configuration in salesforce which makes object access as read only for all users except admin. I have created custom object Invoices in salesforce and want to make that object as readonly when that gets deployed using package link in another org ??? Any kind of help or suggestions are really appreciated......

Answer 1

Object access depends on two settings: Profile/Permission Set Object settings, and the Deployment Status setting on the object itself. This means that any object you create through the UI has either one of two states: Available to only administrators ("In Development"), or available with full access to everyone (all profiles gain all CRUD permissions, but is controlled by the sharing model).

Even using the metadata API, the best you can do without profiles is to give access to nobody at all, similar to the access you'd get with "In Development", but at a profile level. You will necessarily need to adjust the profile settings if you want to prevent users from creating their own records, or deleting or editing records they own, or are granted permission through parental sharing. There's no one-stop shop for creating an object that all users have only read-only access to initially without crafting a metadata call to that effect or manually editing all the profiles.

This is doubly true for packaged objects. The administrator at the far end must choose the security they'd like to use, which means the sharing model is completely outside your control at that point. You can't give an organization an object and not give them full control to determine what level of access users will have to the objects.

Answer 2

A Trigger or Validation Rule can block saving of records based on the Profile of the saving User.

Validation Rule:

($Profile.Name != "System Administrator")

This, unfortunately, may allow a user to think that they are creating an Invoice, but at least it won't allow them to save it. This is a last resort, but if you can't count on Profiles to be configured properly, it will still work.

If you are concerned your Validation Rule may be deactivated, you can use the same logic in an Apex Trigger, it just takes a little more work to do the same thing: block saving unless the user's profile is the correct one.

Answer 3

2 classic answers :

• send the record through an approval process which freezes the record : this is great and works very well, can also be automated with a trigger which starts off the approval process
• a more soft way is to change the record type to switch the presentation page to all field reand-only. This doesn't make the record read-only, but is a very good approximation.

Do these work for you ? Rup

Answer 4

Thanx for the replya Jeremy and all others. I appreciate the information you given. I can use it in some other area. But actually it is not good practice to allow user to enter the record information and then wont allow him to save. That what i am thinking, might your idea would work for other case but for me it would not. I will tell you what i did to make object ReadOnly , I have created custom VF page for tabview of object and New button is excluded from that page , This makes whole object New button hidden behind the VF page. So user not even able to enter record information . And for edit and delete button as well as for action link of the same , I have created custom vf page which give message like "you dont have permission to edit or delete record" . And overrided that page on button and action link of edit and delete. This help me to disallow the record inline edting also.