I have a button to share projects but if the user isn't a sysadmin, neither ownerid, neither has the 'ModifyAllRecords' permissions, system shows an error message

Insert failed. First exception on row 0; first error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, insufficient access rights on cross-reference id: [].

Do you have any idea on how a user can share a project in all cases?


Trigger's code:

trigger ShareProjectPMTrigger on ConfigeroPSA__Engagement__c (before insert) {
        PermissionSetAssignment perm  = [SELECT AssigneeId, Assignee.Name, PermissionSet.Profile.Name
                                FROM PermissionSetAssignment
                                WHERE PermissionSet.Profile.Name='Amministratore del sistema' AND AssigneeId IN
                                  (SELECT UserOrGroupId FROM ConfigeroPSA__Engagement__Share)  AND PermissionSetId IN 
                                  (SELECT ParentId FROM ObjectPermissions WHERE PermissionsModifyAllRecords = true) limit 1];
        for(ConfigeroPSA__Engagement__c job : trigger.new){            
            job.OwnerId = perm.AssigneeId;

Here is the controller:

public with sharing class ShareProjectPMController {

public List <PermissionSetAssignment> permAss ;
public List <String> id_utenti;
public List<permessiUtenti> res{get;set;}
public Id idproj {get;set;}
public List <ConfigeroPSA__Engagement__Share> l_share;
public Integer errore {get;set;}
 public ConfigeroPSA__Engagement__c projce{get;set;}

    public ShareProjectPMController(){

        //return all users with pm authorization
         projce=[SELECT B2W_Company__c,B2W_Company__r.Name FROM ConfigeroPSA__Engagement__c where id=:idProj];
         String agenzia;
          if(projce.B2W_Company__r.Name=='Mind Agency'){
        PermissionSet permPm = [SELECT Id FROM PermissionSet WHERE Name LIKE:agenzia];
        permAss = [SELECT AssigneeId FROM PermissionSetAssignment WHERE PermissionSetId =:permPm.id];
        id_utenti =new List <String>();
        for(PermissionSetAssignment p: permAss ){


    public List<permessiUtenti> getUtentiAssegnati (){
        List <ConfigeroPSA__Engagement__Share> eng_share = [SELECT UserOrGroupId  FROM ConfigeroPSA__Engagement__Share WHERE ParentId=:idproj];
        List <String> id_esistenti= new List <String>();
        for(ConfigeroPSA__Engagement__Share c: eng_share ){
            id_esistenti.add(c.UserOrGroupId  );
         List <User> utenti_assegnati= [SELECT id, Name FROM User where id in:id_utenti AND id !=:userinfo.getuserid() AND id NOT in:id_esistenti];

        system.debug('@@ lista utenti '+utenti_assegnati );
       res =new List<permessiUtenti>();
        for(User u :utenti_assegnati){
            permessiUtenti p= new permessiUtenti(u);
        return res;

    public void setUtentiAssegnati(List<permessiUtenti> l){

    public List<SelectOption> getScelta() {
    List<SelectOption> options = new List<SelectOption>();
    options.add(new SelectOption('0','Seleziona il tipo di privilegio'));
    options.add(new SelectOption('1','Lettura'));
    options.add(new SelectOption('2','Lettura/Scrittura'));

    return options;

    public PageReference approva(){
           system.debug('@@ scelte '+res);
        //save new rights
        l_share = new List<ConfigeroPSA__Engagement__Share>();
        for(permessiUtenti pu:res){
                ConfigeroPSA__Engagement__Share s= new ConfigeroPSA__Engagement__Share (UserOrGroupId=pu.utente.id,ParentId=idproj);
                else if(pu.privilegio=='2'){
                else if(pu.privilegio=='0'){

                    return null;

            insert l_share;
system.debug('@@ l_share'+ l_share);
        return null;


    public PageReference rifiuta(){
        return null;


    public class permessiUtenti{
        public User utente{get;set;}
        public Boolean check {get;set;}
        public String privilegio {get;set;}

        public permessiUtenti(User u){


  • What does your button actually do? Does it go to a Visualforce page, or execute JavaScript? Can you share the code that sits behind the button? Commented Jun 22, 2015 at 13:06
  • Now I write a trigger that starts before insert, to change OwnerId, but it doesn't work. The error now is shown after I try to save the new permission on the project. I have just edited the main post with the trigger code.
    – DarkSkull
    Commented Jun 22, 2015 at 13:27
  • Without any code it is hard to see where you have gone wrong. Commented Jun 22, 2015 at 13:28
  • I've just edited with the trigger's and controller code
    – DarkSkull
    Commented Jun 22, 2015 at 13:30

1 Answer 1


Notice that part of your error message is "INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY"; meaning the user doesn't have proper sharing rights to a related record on another object that's referenced by the one being shared.

You're violating sharing rules to begin with by allowing someone who doesn't own the record (or isn't in the role hierarchy directly above the owner, assuming that's enabled on the custom object) to share the record with others. For that reason alone, to get this to work, you'll likely need to remove "with sharing" from your controller.

Because of the error message noted above, you may also need to figure out which cross reference entity is being referenced that someone might not have access to, that also needs to have sharing extended to it at the same time.

I'll add that I'd strongly urge you to find another way of extending sharing on these records so that the correct people have access to them. You're totally circumventing SF's built-in security model by implementing this button. Anyone could walk up and share records via your trigger with either the janitor or an intern if they chose to.

  • You give me a good advice :) It was enough to replace "public with sharing class" with "public without sharing class". The trigger became useless, so I removed it. Thanks a lot!
    – DarkSkull
    Commented Jun 23, 2015 at 12:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .