I'm building a basic sites page that displays a bunch of widgets based on a contacts address. It references code in a managed package, so I don't have the ability to use without sharing in the extension. I've done the following setup to so the Sites user can see contacts:

  • Contact Read perms on Guest Profile
  • Contact FLS perms on Guest Profile
  • Org-Wide Sharing Model Defaults for Contacts is Controlled by Parent
  • Org-Wide Sharing Model Defaults for Accounts is Public Read/Write

However, when the page is viewed in sites only contacts owned by the guest user can be seen. Any other contacts cause an "Authorization Required" error. Does the Sites Guest user have a special consideration when it comes to the sharing model? Is this documented anywhere? What are my options for making all contacts visible to the guest user if I'm not able to modify the apex to do with sharing?

A highly simplified example page

<apex:page standardController="Contact" extension="mp.extension">

1 Answer 1


Oddly enough, I have the same org wide defaults in my DE site and am able to see contacts.

I set the org-wide defaults to private for contact and was able to see the authorization required error. To address that I created a Group and added the Site's Guest User to it. Then I created a sharing rule to share all of the Contacts with that Group. That allowed me to see the Contacts on a site page even though they were private.

  • Strange that would work in the DE org. I tried a sharing rule as well for all contacts owned by internal users and shared to a Sites User group, but still didn't have any luck. I'm hoping it's just taking a while for the sharing recalculation. Seems like a sharing rule is the way to go if it's not working in the first place. Commented Feb 1, 2013 at 2:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .