I'd like to deploy a Canvas Connected App as part of a managed package and be able to dynamically assign users access to it via a Permission Set.

The Canvas App is using the Signed Request (Post) access method.

Under Manage Apps > Connected Apps > OAuth policies the Permitted Users have been set to "Admin approved users are pre-authorized". On the same screen a Permission Set has been added to the Connected App.

When the Permission Set and Canvas App are deployed as part of a managed package the Permitted Users resets to "All users may self-authorize" in the installing org.

After manually changing Permitted Users to "Admin approved users are pre-authorized" in the target org and attempting to add the managed permission set back to the Connected App I get the error:

Cannot Modify Managed Component
The component you are attempting to modify is part of a managed package, and cannot be modified. For more information, see Insufficient Privileges Errors.

Is this an explicit security restriction to ensure managed packages don't automatically grant users access?
I.e. Only an Admin in the local org can grant access to the App.

Based on App disappears from Permission Set included with package it appears to be a limitation of the packaging process rather than a specific security control.

From Special Behavior of Components in Packages

Permission Sets

You can include permission sets as components in a package, with the following permissions and access settings:

  • Custom object permissions
  • External data source access

Assigned apps and tab settings are not included in permission set components.

So the assigned apps aren't carried over on the permission set currently.

The idea Maintain App and Tab settings for Permission Sets in Managed Packages would be worth promoting.

That leaves the question - How can a managed package control user access to the deployed Connected App?

Maybe if the installing Admin creates a new Permission Set and configures it against the Connected app as a manual post install step. Then the Id of the Permission Set that grants access could be configured into the managed package for creating the PermissionSetAssignment records.

  • 1
  • 1
    were you eventually able to find a solution to this? Cloning the managed permission set and then assigning it works, but seems to defeat the purpose.
    – Mark Pond
    Jul 1 '16 at 17:08
  • 1
    It's amusing and frustrating to find this question and see that I've walked this path before... and still there is no solution to the dilemma.
    – Mark Pond
    Mar 23 '18 at 16:54
  • 1
    @DanielBallinger There may be hope! A new attribute is coming along with v46.0 called isAdminApproved, which when true mean's your Permitted Users setting is set to Admin approved. Interestingly enough, in the metadata, when you change from Admin approved to User approved, isAdminApproved changes to false and the metadata item <permissionSetName>My Connected App User</permissionSetName> also disappears. The reason why permission sets don't carry over is because the User approved setting is defaulted, which clears out the assigned permission sets Jul 4 '19 at 18:24
  • 1
    See the new isAdminApproved attribute in the ConnectedApp Metadata Docs Jul 4 '19 at 18:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.